Executive brief
AshLua is a Lua scripting integration for the Ash framework that allows applications to run custom scripts. A flaw in its aggregate query feature allowed scripts to bypass per-actor field access controls by requesting sensitive data as aggregates (sums, averages, etc.) instead of as regular fields. This could expose restricted PII and other sensitive information that field policies are designed to protect.
Technical details
AshLua exposes Ash read actions to Lua scripts through an eval action, which accepts aggregate operations (list, min, max, first, sum, avg) over named fields. The vulnerability is a broken access control issue in the aggregate query path: while Ash field policies correctly redact forbidden fields on returned records, the redaction logic was not applied to aggregate values. An attacker could request an aggregate over a field restricted by field policies—including fields marked public but scoped per-actor—and retrieve the raw value, bypassing authorization checks. The fix adds authorization checks for aggregated fields against the resource's field policies, rejecting or scoping aggregates to visible rows.
Affected products
- Elixir Ash project AshLua 0.1.0 before 0.2.2
Timeline
- 2026-09-08: disclosed: CVE-2026-78216 published
- 2026-09-08: patched: Fix available in version 0.2.2