Incorrect Authorization Vulnerability in Ash Framework by Ash Project

CVE-2026-82749

What is CVE-2026-82749?

A vulnerability exists in the Ash Framework where, due to an incorrect resolution of parent relationships, unauthorized records may be retrieved via a wide scoping filter. This flaw arises in scenarios where a parent reference fails to resolve and defaults to nil rather than producing an error. Consequently, records intended to be excluded by the defined scope are accessible, thus compromising data security. The fix mandates an error response when a parent reference cannot be resolved, reinforcing strict access control. Affected versions range from 3.13.2 to prior to 3.32.2.

References