Executive brief
Ash is a Elixir data layer and admin framework that uses policies to control what data different users can access. A bug in runtime read policies causes the system to incorrectly return records that should be forbidden, exposing data to unauthorized users regardless of their role or permissions.
Technical details
The vulnerability is an authorization bypass in Ash.Policy.Authorizer's check_result/1 function (lib/ash/policy/authorizer/authorizer.ex). When evaluating access_type :runtime read policies (per-record checks rather than compiled filters), the code discards impossible policy scenarios. When all scenarios are impossible for a record—meaning no policy authorizes it and it must be denied—the empty-scenario branch incorrectly retained and returned the record as authorized instead of forbidding it. The fix rejects any record whose policy scenarios are all impossible. The vulnerability requires the application to use runtime read policies; no authentication bypass or network exploitation is required beyond normal application access.
Affected products
- ash-project Ash 3.4.44 before 3.32.2
Timeline
- 2026-09-01: disclosed