# CVE-2025-48043: Ash Framework Authentication Bypass in Policy Authorizer

Source: https://junglewise.ai/threats/cve-2025-48043-ash-framework-authentication-bypass-in-policy-authorizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2025-48043 · Severity: info · CVSS 8.6 · Published 2025-10-10

Ash is a declarative framework for building Elixir applications. A vulnerability in its authorization system could allow users to bypass security policies and access data or perform actions they are not permitted to. This occurs because certain security rules that should block access are incorrectly ignored during the filtering process.

## Quick answers

**Is CVE-2025-48043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48043 being exploited in the wild.

**How severe is CVE-2025-48043?** Informational severity, with a CVSS score of 8.6, published 10 October 2025.

**Which products and versions are affected?** ash-project ash from 0.1.0 before 3.6.2.

**Is there a fix for CVE-2025-48043?** A patch was published on 2025-10-10: Fixed in version 3.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48043 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-48043?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability exists in the Ash framework's policy authorizer. The flaw is located in the 'Elixir.Ash.Policy.Authorizer':strict_filters/2 routine within lib/ash/policy/authorizer/authorizer.ex. It stems from the SAT solver and filter reduction logic incorrectly applying or ignoring bypass and runtime policies that are logically determined to never pass. An attacker with basic network access and low privileges could exploit this to bypass intended access controls and achieve unauthorized data access or modification. The issue is resolved in version 3.6.2.

## Affected products

- ash-project ash from 0.1.0 before 3.6.2

## Timeline

- 2025-10-10: disclosed
- 2025-10-10: patched: Fixed in version 3.6.2

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2025-48043.html](https://cna.erlef.org/cves/CVE-2025-48043.html)
- [https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae](https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae)
- [https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7](https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7)