CVE-2026-78216: AshLua Aggregate Read Vulnerability Exposes Restricted Fields
Summary
CVE-2026-78216: AshLua eval read operations can read field-policy-protected fields via aggregates. Affects ash_lua across 2 version ranges.
>= 0.1.0, < 0.2.2
>= 8675e47cca81f36594083a7e63379bac9e123e72, < 266a5dcc56d5015b6d316c10606169e753b07450
Fixed in 0.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshLua is a library that allows Lua scripts to interact with the Ash framework, enabling dynamic read actions through an eval action. It supports various operations such as listing, aggregating, and manipulating data. However, it has a vulnerability that allows unauthorized access to sensitive fields through aggregate operations, bypassing field policies.
Vulnerability Detail
The vulnerability arises from AshLua's handling of read actions via the eval function, which permits Lua scripts to perform operations on fields. While Ash field policies are designed to protect sensitive data by redacting forbidden fields, this protection does not extend to aggregate values. Consequently, an attacker could exploit this by requesting sensitive fields as aggregates, thus circumventing the intended access controls. This flaw primarily affects versions of ash_lua from 0.1.0 to before 0.2.2, allowing unauthorized access to potentially sensitive personal information.
How To Fix
Latest published version: 0.2.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing the AshLua eval action over resources that have field policies restricting access to sensitive fields. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2026-78216 highlights a significant vulnerability in the AshLua library that can lead to unauthorized access to sensitive fields through aggregate operations. It is crucial for developers using this library to update to the patched version and consider implementing workarounds to protect sensitive data until the update can be applied.
See every vulnerability recorded for ash_lua →
FAQ
CVE-2026-78216 is a vulnerability in the AshLua library that allows unauthorized access to restricted fields through aggregate read operations.
The vulnerability affects ash_lua versions from 0.1.0 to before 0.2.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.0, indicating a moderate level of severity.
If an immediate update is not possible, consider restricting access to the eval action in AshLua to mitigate the risk of unauthorized data access.
Related vulnerabilities
Recent vulnerabilities recorded for ash_lua.
