CVE-2026-77454: AshSql Incorrect Authorization Vulnerability Leading to Bypass of Scoping Filters
Summary
CVE-2026-77454: exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql. Affects ash_sql across 2 version ranges.
>= 0.4.1, < 0.7.1
>= e26a63b29bd7501505fafd726f14262cdc3b6629, < 865fdd4e5e70724a23b19c048e6768c31d2209ab
Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshSql is a powerful library within the Ash framework that facilitates SQL interactions for Elixir applications. It provides a robust way to manage database queries while ensuring that data access is appropriately scoped and authorized. However, a recent vulnerability has been identified that allows unauthorized access under specific conditions, compromising the integrity of the authorization mechanisms.
Vulnerability Detail
The vulnerability arises from an incorrect implementation in the AshSql library, specifically in the handling of the exists/2 predicate when used with relationships that have both a limit and a parent-referencing filter. When such a relationship is queried, the exists predicate is silently dropped, leading to a situation where any record can be matched if it has any related row. This can result in unauthorized access, especially when the expression is used in a policy that should restrict access based on the actor's identity. The vulnerability affects versions of AshSql from 0.4.1 to below 0.7.1.
How To Fix
Latest published version: 0.8.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the exists/2 predicate in filters or policies over relationships that declare both a limit and a parent-referencing filter. Instead, consider restructuring your queries to avoid this specific combination until the package can be updated.
Conclusion
The CVE-2026-77454 vulnerability in AshSql poses a significant risk by allowing unauthorized access through improperly handled queries. It is crucial for developers using affected versions to update to the patched version 0.7.1 or later to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ash_sql →
FAQ
CVE-2026-77454 is a vulnerability in the AshSql library that allows unauthorized access by bypassing scoping filters.
Versions from 0.4.1 to below 0.7.1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid using the exists/2 predicate in the specified context as a temporary workaround.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_sql.
