Is CVE-2026-80223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80223 being exploited in the wild.

How severe is CVE-2026-80223?

Informational severity, published 30 August 2026.

Which products and versions are affected?

Ash-Project Ash Graphql 1.4.0 before 1.11.0.

Is there a fix for CVE-2026-80223?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-80223?

Check whether you run Ash-Project Ash Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80223: ash-project ash_graphql incorrect authorization in subscriptions

CVE-2026-80223 · Severity: info · Published 2026-08-30

ash_graphql is a GraphQL integration library for the Ash framework that allows applications to expose data through GraphQL subscriptions. A flaw in subscription authorization allows an authenticated user subscribed to data in one tenant to receive records from other tenants, bypassing multi-tenant data isolation. This can result in unauthorized access to sensitive business data across customer boundaries.

Technologies: Ash-Project Ash Graphql. Vendors: Ash-Project.

Quick answers

Is CVE-2026-80223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80223 being exploited in the wild.
How severe is CVE-2026-80223?: Informational severity, published 30 August 2026.
Which products and versions are affected?: Ash-Project Ash Graphql 1.4.0 before 1.11.0.
Is there a fix for CVE-2026-80223?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-80223?: Check whether you run Ash-Project Ash Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization flaw in AshGraphql.Graphql.Resolver's subscription notification handling. The resolver evaluates read policy filters in-memory using Ash.can/3 with run_queries?: false, which evaluates filters via Ash.Expr.eval/2 without issuing a database query. Since Ash applies multi-tenancy at query-build time, not within query filters, the evaluated policy carries no tenant condition. Consequently, when a notification from tenant B is routed to a subscriber in tenant A, it is emitted if the policy filter evaluates to true, regardless of tenant. The single-notification code path has no tenant guard, and the batched path checks only the head of the notification list. Tenant-scoped reads are only reached when filter evaluation fails. Authentication is required; any authenticated subscriber can receive cross-tenant data. Affected versions: ash_graphql 1.4.0 through 1.10.x; patch available in 1.11.0.

Affected products

ash-project ash_graphql 1.4.0 before 1.11.0

Timeline

2026-08-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.