Executive brief
ash_sql is a SQL query builder library used in Elixir applications to define complex data filtering and authorization rules. A flaw in how it processes authorization checks allows callers to bypass scoping filters when accessing related records, potentially exposing data or granting unauthorized access to users who would normally be denied by the application's access control policies.
Technical details
The vulnerability is an authorization bypass in AshSql.Join.related_query/3 where the caller-supplied exists/2 predicate is incorrectly skipped for relationships that declare both a limit and a parent(...)-referencing filter or sort. When such a relationship is evaluated, limit_from_many/5 drops both the limit and the predicate, emitting a bare correlated EXISTS with no filtering condition. This causes authorization policies backed by exists expressions (e.g., authorize_if expr(exists(memberships, user_id == ^actor(:id)))) to pass for any actor with any related record, regardless of the intended scoping condition. The attack is network-adjacent or local depending on application exposure; no authentication bypass is required if the vulnerable code path is reachable. Affected versions: ash_sql 0.4.1 through 0.7.0. A patch is available in version 0.7.1 and later.
Affected products
- ash-project ash_sql 0.4.1 through 0.7.0
Timeline
- 2026-08-30: published: Vulnerability published