Executive brief
Ash is a declarative framework for building applications in Elixir. A flaw in its authorization logic allows users to bypass security policies under specific conditions. This could allow unauthorized individuals to access or modify sensitive data that should have been restricted by the system's 'bypass' rules.
Technical details
An incorrect authorization vulnerability exists in the Ash framework's policy enforcement engine. The root cause is located in `lib/ash/policy/policy.ex` within the `Ash.Policy.Policy.expression/2` routine, where bypass policies incorrectly contributed only their condition (rather than their complete expression including authorization checks) to the 'one_condition_matches' requirement. This logic error allows a request to be authorized if a bypass condition evaluates to true, even if the associated authorization check fails and no other policies apply. Attackers with low-privileged access can exploit this to perform actions they are not authorized for. The issue is fixed in version 3.7.1 by ensuring the complete expression is used for authorization decisions.
Affected products
- ash-project ash >= 3.6.3, < 3.7.1
Timeline
- 2025-10-17: advisory: GitHub Advisory GHSA-pcxq-fjp3-r752 published
- 2025-10-17: patched: Fix committed in version 3.7.1