Authorization Flaw in Ash Framework Affecting Data Policies

CVE-2026-82748

What is CVE-2026-82748?

The Ash Framework contains an incorrect authorization vulnerability where an aggregate can operate under a different action than what it was authorized for. This discrepancy allows the aggregate to execute with more permissive policies, potentially revealing sensitive data that should be restricted. The issue arises when the aggregate query runs under an action selected without proper alignment to the authorized read action. Consequently, unauthorized users might access data they are not permitted to see, as aggregates may calculate over records that should be excluded based on read policies. A patch has been implemented to ensure that aggregates run under the same read_action as their authorization, mitigating this risk.

References