# CVE-2025-48044: Ash Framework authorization bypass in bypass policy logic

Source: https://junglewise.ai/threats/cve-2025-48044-ash-framework-authorization-bypass-in-bypass-policy-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-17. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2025-48044 · Severity: info · CVSS 8.6 · Published 2025-10-17

Ash is a declarative framework for building applications in Elixir. A flaw in its authorization logic allows users to bypass security policies under specific conditions. This could allow unauthorized individuals to access or modify sensitive data that should have been restricted by the system's 'bypass' rules.

## Quick answers

**Is CVE-2025-48044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48044 being exploited in the wild.

**How severe is CVE-2025-48044?** Informational severity, with a CVSS score of 8.6, published 17 October 2025.

**Which products and versions are affected?** ash-project ash >= 3.6.3, < 3.7.1.

**Is there a fix for CVE-2025-48044?** A patch was published on 2025-10-17: Fix committed in version 3.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48044 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-48044?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability exists in the Ash framework's policy enforcement engine. The root cause is located in `lib/ash/policy/policy.ex` within the `Ash.Policy.Policy.expression/2` routine, where bypass policies incorrectly contributed only their condition (rather than their complete expression including authorization checks) to the 'one_condition_matches' requirement. This logic error allows a request to be authorized if a bypass condition evaluates to true, even if the associated authorization check fails and no other policies apply. Attackers with low-privileged access can exploit this to perform actions they are not authorized for. The issue is fixed in version 3.7.1 by ensuring the complete expression is used for authorization decisions.

## Affected products

- ash-project ash >= 3.6.3, < 3.7.1

## Timeline

- 2025-10-17: advisory: GitHub Advisory GHSA-pcxq-fjp3-r752 published
- 2025-10-17: patched: Fix committed in version 3.7.1

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2025-48044.html](https://cna.erlef.org/cves/CVE-2025-48044.html)
- [https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d](https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d)
- [https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752](https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752)