CVE-2025-48043: Ash Framework Authentication Bypass in Policy Authorizer

Executive brief

Ash is a declarative framework for building Elixir applications. A vulnerability in its authorization system could allow users to bypass security policies and access data or perform actions they are not permitted to. This occurs because certain security rules that should block access are incorrectly ignored during the filtering process.

Technical details

An incorrect authorization vulnerability exists in the Ash framework's policy authorizer. The flaw is located in the 'Elixir.Ash.Policy.Authorizer':strict_filters/2 routine within lib/ash/policy/authorizer/authorizer.ex. It stems from the SAT solver and filter reduction logic incorrectly applying or ignoring bypass and runtime policies that are logically determined to never pass. An attacker with basic network access and low privileges could exploit this to bypass intended access controls and achieve unauthorized data access or modification. The issue is resolved in version 3.6.2.

Affected products

• ash-project ash from 0.1.0 before 3.6.2

Timeline

• 2025-10-10: disclosed
• 2025-10-10: patched: Fixed in version 3.6.2

References

• https://repo.hex.pm/
• https://github.com/
• https://cna.erlef.org/cves/CVE-2025-48043.html
• https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae
• https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7