CVE-2026-82748: Ash Package Incorrect Authorization Vulnerability
Summary
CVE-2026-82748: Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another. Affects ash across 2 version ranges.
>= 3.5.13, < 3.32.2
>= d2e99980380cad610dbab3c4167e85323244bc71, < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is a powerful framework designed for building APIs in Elixir. It provides a set of tools for defining resources, actions, and policies, allowing developers to create robust applications with ease. However, a recent vulnerability has been identified that affects versions from 3.5.13 to 3.32.2, where incorrect authorization can lead to unauthorized data access.
Vulnerability Detail
The vulnerability arises from an incorrect authorization mechanism within Ash.Actions.Aggregate. It authorizes an aggregate under one read action while computing it under another, leading to potential data exposure. Specifically, when a caller passes an :action option, the aggregate query runs under that action, which may have more permissive read policies than the authorized one. This discrepancy can allow an aggregate (such as a count or sum) to be computed over records that the authorized action's policies would have excluded, thereby disclosing sensitive information.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the :action option in aggregate queries until the package is updated. This will ensure that the aggregates are computed under the correct read action and prevent unauthorized data access.
Conclusion
The CVE-2026-82748 vulnerability in the Ash package poses a risk of unauthorized data exposure due to incorrect authorization in aggregate actions. It is crucial for developers using affected versions to update to 3.32.2 or higher to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82748 is a vulnerability in the Ash package that allows incorrect authorization of aggregates, potentially leading to unauthorized data exposure.
The vulnerability affects Ash versions from 3.5.13 up to, but not including, 3.32.2.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 2.1, indicating a low severity level.
If you cannot update the package right away, avoid using the :action option in aggregate queries as a temporary workaround to prevent unauthorized data access.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
