Is CVE-2026-77454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77454 being exploited in the wild.

How severe is CVE-2026-77454?

Informational severity, with a CVSS score of 7.5, published 30 August 2026.

Which products and versions are affected?

Ash-Project Ash Sql 0.4.1 through 0.7.0.

Is there a fix for CVE-2026-77454?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77454 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-77454?

Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77454: ash-project ash_sql authorization bypass in exists filter

CVE-2026-77454 · Severity: info · CVSS 7.5 · Published 2026-08-30

ash_sql is a SQL query builder library used in Elixir applications to define complex data filtering and authorization rules. A flaw in how it processes authorization checks allows callers to bypass scoping filters when accessing related records, potentially exposing data or granting unauthorized access to users who would normally be denied by the application's access control policies.

Technologies: Ash-Project Ash Sql. Vendors: Ash-Project.

Quick answers

Is CVE-2026-77454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77454 being exploited in the wild.
How severe is CVE-2026-77454?: Informational severity, with a CVSS score of 7.5, published 30 August 2026.
Which products and versions are affected?: Ash-Project Ash Sql 0.4.1 through 0.7.0.
Is there a fix for CVE-2026-77454?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77454 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-77454?: Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in AshSql.Join.related_query/3 where the caller-supplied exists/2 predicate is incorrectly skipped for relationships that declare both a limit and a parent(...)-referencing filter or sort. When such a relationship is evaluated, limit_from_many/5 drops both the limit and the predicate, emitting a bare correlated EXISTS with no filtering condition. This causes authorization policies backed by exists expressions (e.g., authorize_if expr(exists(memberships, user_id == ^actor(:id)))) to pass for any actor with any related record, regardless of the intended scoping condition. The attack is network-adjacent or local depending on application exposure; no authentication bypass is required if the vulnerable code path is reachable. Affected versions: ash_sql 0.4.1 through 0.7.0. A patch is available in version 0.7.1 and later.

Affected products

ash-project ash_sql 0.4.1 through 0.7.0

Timeline

2026-08-30: published: Vulnerability published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.