Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected. This issue affects ash: from 2.6.0 before 3.34.6.
CVE-2026-101028
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-101028
ash
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
ash
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"modules": [
"'Elixir.Ash.Actions.Aggregate'",
"'Elixir.Ash'"
],
"product": "ash",
"versions": [
{
"status": "affected",
"version": "2.6.0",
"lessThan": "3.34.6",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/ash",
"packageName": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Ash.Actions.Aggregate':run/4"
},
{
"name": "'Elixir.Ash':count/2"
},
{
"name": "'Elixir.Ash':exists/2"
},
{
"name": "'Elixir.Ash':aggregate/3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"modules": [
"'Elixir.Ash.Actions.Aggregate'",
"'Elixir.Ash'"
],
"product": "ash",
"versions": [
{
"status": "affected",
"version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c",
"lessThan": "80936187b27ee94f15cd875affd3141b5cb23185",
"versionType": "git"
}
],
"packageURL": "pkg:github/ash-project/ash",
"packageName": "ash-project/ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Ash.Actions.Aggregate':run/4"
},
{
"name": "'Elixir.Ash':count/2"
},
{
"name": "'Elixir.Ash':exists/2"
},
{
"name": "'Elixir.Ash':aggregate/3"
}
]
}
]- Related CVEs
- CVE-2026-101028
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #16425 · Revision 1
- Added to Heist Feed
- Publisher date