Skip to content
Ash-project Ash vulnerabilities
-
ash-project ash
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
CVE-2026-96581
Fix available
7.6 High
-
ash-project ash postgres
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
CVE-2026-115627
Fix available
6.0 Medium
-
ash-project ash postgres
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
CVE-2026-115635
Fix available
6.0 Medium
-
ash-project ash
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
CVE-2026-114214
Fix available
6.0 Medium
-
ash-project ash typescript
Internal error terms inspected into AshTypescript RPC error responses
CVE-2026-105283
Fix available
6.3 Medium
-
ash-project ash
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
CVE-2026-101028
Fix available
6.0 Medium
-
ash-project ash
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
CVE-2026-94201
Fix available
8.2 High
-
ash-project ash
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
CVE-2026-93477
Fix available
5.9 Medium
-
ash-project ash authentication phoenix, team-alembic ash authentication +1 more
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
CVE-2026-86533
Fix available
9.1 Critical
-
ash-project ash authentication phoenix, team-alembic ash authentication +1 more
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-81632
Fix available
7.2 High
-
ash-project ash
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
CVE-2026-86338
Fix available
6.0 Medium
-
ash-project ash lua
AshLua eval read operations can read field-policy-protected fields via aggregates
CVE-2026-78216
Fix available
6.0 Medium
-
ash-project ash ai
AshAi aggregate tool can read field-policy-protected fields
CVE-2026-78230
Fix available
6.0 Medium
-
ash-project ash lua
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
CVE-2026-82586
Fix available
8.2 High
-
ash-project ash double entry
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
CVE-2026-81638
Fix available
2.1 Low
-
ash-project ash authentication oauth2 server
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
CVE-2026-82758
Fix available
6.3 Medium
-
ash-project ash authentication oauth2 server
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
CVE-2026-82757
Fix available
6.3 Medium
-
ash-project ash authentication oauth2 server
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
CVE-2026-82756
Fix available
6.3 Medium
-
ash-project ash authentication oauth2 server
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
CVE-2026-82755
Fix available
6.3 Medium
-
ash-project ash authentication oauth2 server
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
CVE-2026-82754
Fix available
6.3 Medium
-
ash-project ash authentication oauth2 server
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
CVE-2026-82753
Fix available
8.2 High
-
ash-project ash
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
CVE-2026-82752
Fix available
5.9 Medium
-
ash-project ash
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82747
Fix available
5.9 Medium
-
ash-project ash
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82749
Fix available
5.9 Medium
-
ash-project ash
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82748
Fix available
2.1 Low
-
ash-project ash
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
CVE-2026-82746
Fix available
5.9 Medium
-
ash-project ash
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
CVE-2026-82745
Fix available
5.9 Medium
-
ash-project ash
Ash.Reactor change step fails open, skipping a change when its where guard raises
CVE-2026-82744
Fix available
2.1 Low
-
ash-project ash
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82743
Fix available
2.1 Low
-
ash-project ash
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
CVE-2026-82742
Fix available
5.9 Medium
-
ash-project ash
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82741
Fix available
2.1 Low
-
ash-project ash
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82740
Fix available
2.1 Low
-
ash-project ash
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
CVE-2026-82739
Fix available
2.1 Low
-
ash-project ash
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
CVE-2026-82738
Fix available
5.9 Medium
-
ash-project ash
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
CVE-2026-82737
Fix available
5.9 Medium
-
ash-project ash
Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
CVE-2026-82736
Fix available
2.1 Low
-
ash-project ash
Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82735
Fix available
5.9 Medium
-
ash-project ash
Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82734
Fix available
2.1 Low
-
ash-project ash typescript
Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
CVE-2026-82731
Fix available
2.3 Low
-
ash-project ash typescript
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
CVE-2026-74837
Fix available
8.7 High
-
ash-project ash typescript
Route handler return value echoed into AshTypescript error response
CVE-2026-82733
Fix available
6.3 Medium
-
ash-project ash typescript
Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82732
Fix available
6.3 Medium
-
ash-project ash typescript
Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-82730
Fix available
8.2 High
-
ash-project ash typescript
RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-77950
Fix available
6.3 Medium
-
ash-project ash typescript
Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-77856
Fix available
8.2 High
-
ash-project ash phoenix
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
CVE-2026-82725
Fix available
2.3 Low
-
ash-project ash phoenix
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
CVE-2026-82724
Fix available
7.6 High
-
ash-project ash phoenix
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
CVE-2026-82726
Fix available
6.3 Medium
-
ash-project ash phoenix
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
CVE-2026-82727
Fix available
2.3 Low
-
ash-project ash admin
Path traversal in AshAdmin file uploads via unsanitized client filename
CVE-2026-82673
Fix available
8.3 High
- Show olderLoading…