Executive brief
Ash is a framework that powers backend data operations. A flaw in its aggregate function (used for counts and sums) allows an operation to run under a different authorization policy than the one checked beforehand, potentially exposing aggregate statistics (like counts or sums) for data that the user should not be able to access.
Technical details
The vulnerability is an authorization bypass in Ash's aggregate action handler. The framework groups aggregates by their authorized read action and checks permissions against that action, but when building the actual query, it selects the action based on opts[:action] || read_action || default_primary_read. If a caller passes an :action option that differs from the authorized read_action, the aggregate executes under the more permissive action's policies while authorization was computed for the original action. This allows computation of aggregates (count, sum) over records the authorized policy would have excluded, disclosing information through aggregate statistics. The fix ensures aggregates run under the same read_action they were authorized against.
Affected products
- Ash Project Ash 3.5.13 to before 3.32.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in version 3.32.2