Executive brief
ash_graphql is a GraphQL integration library for the Ash framework that allows applications to expose data through GraphQL subscriptions. A flaw in subscription authorization allows an authenticated user subscribed to data in one tenant to receive records from other tenants, bypassing multi-tenant data isolation. This can result in unauthorized access to sensitive business data across customer boundaries.
Technical details
The vulnerability is an incorrect authorization flaw in AshGraphql.Graphql.Resolver's subscription notification handling. The resolver evaluates read policy filters in-memory using Ash.can/3 with run_queries?: false, which evaluates filters via Ash.Expr.eval/2 without issuing a database query. Since Ash applies multi-tenancy at query-build time, not within query filters, the evaluated policy carries no tenant condition. Consequently, when a notification from tenant B is routed to a subscriber in tenant A, it is emitted if the policy filter evaluates to true, regardless of tenant. The single-notification code path has no tenant guard, and the batched path checks only the head of the notification list. Tenant-scoped reads are only reached when filter evaluation fails. Authentication is required; any authenticated subscriber can receive cross-tenant data. Affected versions: ash_graphql 1.4.0 through 1.10.x; patch available in 1.11.0.
Affected products
- ash-project ash_graphql 1.4.0 before 1.11.0
Timeline
- 2026-08-30: disclosed