CVE-2026-101028: Ash Package Authorization Bypass in Filters and Sorts
Summary
CVE-2026-101028: Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts. Affects ash across 2 version ranges.
>= 2.6.0, < 3.34.6
>= 30eaf1c6e8524527b703e3c4bfeff7967ee0b37c, < 80936187b27ee94f15cd875affd3141b5cb23185
Fixed in 3.34.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is a powerful framework for building APIs and data-driven applications in Elixir. It provides a rich set of features for managing resources, relationships, and actions, allowing developers to create complex data interactions with ease. However, a recent vulnerability has been identified that affects its ability to enforce read policies on related resources, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from an incorrect authorization implementation in the Ash framework, specifically in the methods Ash.count/2, Ash.exists/2, and Ash.aggregate/3. These methods fail to apply the read policies of related resources when processing filters and sorts. As a result, an unauthorized actor can infer the existence and attributes of related records that they should not have access to. This issue is particularly concerning when caller-supplied filters or sorts are used, as it allows for unauthorized data access through crafted queries.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.34.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers should avoid using caller-supplied filters or sorts that cross relationships in the affected methods until the package is updated. This can help mitigate the risk of unauthorized data exposure.
Conclusion
CVE-2026-101028 represents a significant security risk for applications using the Ash framework, particularly those that allow user-defined filters and sorts. It is crucial for developers to update to the latest version of the package to mitigate this vulnerability and protect sensitive data.
See every vulnerability recorded for ash →
FAQ
CVE-2026-101028 is a vulnerability in the Ash package that allows unauthorized access to related resources' data through improper enforcement of read policies.
If your application uses Ash and allows caller-supplied filters or sorts, it may expose sensitive data from related records that users should not have access to.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability without requiring code access. Visit Vulert Scanner for more information.
As a temporary measure, avoid using filters or sorts that cross relationships in the affected methods until you can update to the patched version.
The CVSS score for CVE-2026-101028 is 6.0, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
