Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6251 vulnerabilities reference this CWE, most recent first.
CVE-2026-82879 (GCVE-0-2026-82879)
Vulnerability from cvelistv5 – Published: 2026-08-31 10:51 – Updated: 2026-08-31 18:51
VLAI
EPSS
VEX
Title
DataEase before 2.10.26 Access Control Bypass via Share Tickets
Summary
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/dataease/dataease/security/adv… | vendor-advisory |
| https://github.com/dataease/dataease/commit/fbbb0… | patch |
| https://github.com/dataease/dataease/releases/tag… | release-notes |
| https://github.com/dataease/dataease | product |
| https://www.vulncheck.com/advisories/dataease-bef… | third-party-advisory |
Impacted products
Date Public
2026-07-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:03.765571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:51:31.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dataease/dataease",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dataease/dataease",
"product": "dataease",
"repo": "https://github.com/dataease/dataease",
"vendor": "dataease",
"versions": [
{
"lessThan": "2.10.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.10.26",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.10.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dikai Zou"
}
],
"datePublic": "2026-07-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the \u0027ticket mandatory\u0027 policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user\u0027s ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users\u0027 share mappings."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T10:51:05.222Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9h54-39gh-5qfg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/dataease/dataease/security/advisories/GHSA-9h54-39gh-5qfg"
},
{
"tags": [
"patch"
],
"url": "https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db"
},
{
"name": "DataEase v2.10.26 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/dataease/dataease/releases/tag/v2.10.26"
},
{
"tags": [
"product"
],
"url": "https://github.com/dataease/dataease"
},
{
"name": "VulnCheck Advisory: DataEase before 2.10.26 Access Control Bypass via Share Tickets",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dataease-before-2.10.26-access-control-bypass-via-share-tickets"
}
],
"title": "DataEase before 2.10.26 Access Control Bypass via Share Tickets",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82879",
"datePublished": "2026-08-31T10:51:05.222Z",
"dateReserved": "2026-08-31T08:38:43.268Z",
"dateUpdated": "2026-08-31T18:51:31.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82875 (GCVE-0-2026-82875)
Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 14:45
VLAI
EPSS
VEX
Title
ToolJet before v3.16.208 Authorization Bypass via organizationId
Summary
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:45 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ToolJet/ToolJet/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/tooljet-befo… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82875",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:45:00.939420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:45:27.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/tooljet",
"product": "ToolJet",
"vendor": "ToolJet",
"versions": [
{
"lessThan": "3.16.208",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.208",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.208",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JohannesLks"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user\u0027s workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T08:46:43.077Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cx42-x23w-vhvf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf"
},
{
"name": "VulnCheck Advisory: ToolJet before v3.16.208 Authorization Bypass via organizationId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationid"
}
],
"title": "ToolJet before v3.16.208 Authorization Bypass via organizationId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82875",
"datePublished": "2026-08-31T08:46:43.077Z",
"dateReserved": "2026-08-31T08:38:43.268Z",
"dateUpdated": "2026-08-31T14:45:27.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82749 (GCVE-0-2026-82749)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:54 – Updated: 2026-09-01 03:54
VLAI
EPSS
VEX
Title
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
Summary
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.
Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.
This issue affects ash: from 3.13.2 before 3.32.2.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82749.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82749 | related |
| https://github.com/ash-project/ash/commit/e52dad2… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.13.2 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0ddff26e6e6bc6d182e1af2f98b431575e5b4179 , < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.13.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:resolve_parent_in_filter/3"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:do_per_record_no_attributes_load/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e52dad2c39a35f6f043f7324d26e4f4e2551dfd2",
"status": "affected",
"version": "0ddff26e6e6bc6d182e1af2f98b431575e5b4179",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.13.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s \u003ccode\u003eparent(...)\u003c/code\u003e scoping filter to match unintended records when the referenced parent field cannot be resolved.\u003c/p\u003e\n\u003cp\u003eLoading a relationship whose filter references \u003ccode\u003eparent(...)\u003c/code\u003e resolves that expression against the parent record. \u003ccode\u003eresolve_parent_in_filter/3\u003c/code\u003e (\u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to \u003ccode\u003enil\u003c/code\u003e rather than failing. A scoping predicate such as \u003ccode\u003eorg_id == parent(org_id)\u003c/code\u003e then becomes an \u003ccode\u003eIS NULL\u003c/code\u003e match, and a guard like \u003ccode\u003eis_nil(parent(org_id)) or org_id == parent(org_id)\u003c/code\u003e activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a \u003ccode\u003eparent(...)\u003c/code\u003e reference cannot be resolved, instead of defaulting to nil.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.13.2 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s `parent(...)` scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references `parent(...)` resolves that expression against the parent record. `resolve_parent_in_filter/3` (`lib/ash/actions/read/relationships.ex`) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to `nil` rather than failing. A scoping predicate such as `org_id == parent(org_id)` then becomes an `IS NULL` match, and a guard like `is_nil(parent(org_id)) or org_id == parent(org_id)` activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a `parent(...)` reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash widens a relationship\u0027s parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.\n\nLoading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.\n\nThis issue affects ash: from 3.13.2 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:54:12.716Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82749.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82749"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e52dad2c39a35f6f043f7324d26e4f4e2551dfd2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82749",
"datePublished": "2026-09-01T03:54:12.716Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T03:54:12.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82748 (GCVE-0-2026-82748)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:52 – Updated: 2026-09-01 03:52
VLAI
EPSS
VEX
Title
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
Summary
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.
Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.
This issue affects ash: from 3.5.13 before 3.32.2.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82748.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82748 | related |
| https://github.com/ash-project/ash/commit/2d9b78b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.5.13 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
d2e99980380cad610dbab3c4167e85323244bc71 , < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.5.13",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2d9b78b87d2dc72885a8aa1d660b478d42f749f7",
"status": "affected",
"version": "d2e99980380cad610dbab3c4167e85323244bc71",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate\u003c/code\u003e groups aggregates by their \u003ccode\u003e{authorize?, read_action}\u003c/code\u003e and authorizes each group under that read action, but when building the data query it selected the action as \u003ccode\u003eopts[:action] || read_action || \u0026lt;primary read\u0026gt;\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e). When a caller passed an \u003ccode\u003e:action\u003c/code\u003e option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own \u003ccode\u003eread_action\u003c/code\u003e. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same \u003ccode\u003eread_action\u003c/code\u003e it is authorized against.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.13 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\n`Ash.Actions.Aggregate` groups aggregates by their `{authorize?, read_action}` and authorizes each group under that read action, but when building the data query it selected the action as `opts[:action] || read_action || \u003cprimary read\u003e` (`lib/ash/actions/aggregate.ex`). When a caller passed an `:action` option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own `read_action`. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same `read_action` it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:52:01.686Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82748.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82748"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82748",
"datePublished": "2026-09-01T03:52:01.686Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T03:52:01.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82747 (GCVE-0-2026-82747)
Vulnerability from cvelistv5 – Published: 2026-09-01 04:14 – Updated: 2026-09-01 04:14
VLAI
EPSS
VEX
Title
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
Summary
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.
This issue affects ash: from 3.4.44 before 3.32.2.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82747.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82747 | related |
| https://github.com/ash-project/ash/commit/6eddb8a… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.4.44 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
f4a8ff53fd3b974468d73685cd3fc842ef893de3 , < 6eddb8ab26e45023faf0c79ebd152bb40aefda02
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.4.44",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:check_result/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6eddb8ab26e45023faf0c79ebd152bb40aefda02",
"status": "affected",
"version": "f4a8ff53fd3b974468d73685cd3fc842ef893de3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.4.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\u003c/p\u003e\n\u003cp\u003eWhen a resource has an \u003ccode\u003eaccess_type :runtime\u003c/code\u003e read policy (a check evaluated per record rather than compiled to a filter), \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e decides each record in \u003ccode\u003echeck_result/1\u003c/code\u003e (\u003ccode\u003elib/ash/policy/authorizer/authorizer.ex\u003c/code\u003e) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (\u003ccode\u003e{[record | data], authorizer, any_forbidden?}\u003c/code\u003e) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.4.44 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an `access_type :runtime` read policy (a check evaluated per record rather than compiled to a filter), `Ash.Policy.Authorizer` decides each record in `check_result/1` (`lib/ash/policy/authorizer/authorizer.ex`) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record (`{[record | data], authorizer, any_forbidden?}`) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.\n\nWhen a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.\n\nThis issue affects ash: from 3.4.44 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T04:14:57.840Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82747.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82747"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6eddb8ab26e45023faf0c79ebd152bb40aefda02"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82747",
"datePublished": "2026-09-01T04:14:57.840Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T04:14:57.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82730 (GCVE-0-2026-82730)
Vulnerability from cvelistv5 – Published: 2026-09-01 02:09 – Updated: 2026-09-01 02:09
VLAI
EPSS
VEX
Title
Authorization-redacted field values disclosed through AshTypescript result normalization
Summary
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.
When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial.
The simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path.
This issue affects ash_typescript: from 0.11.0 before 0.18.0.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-82730.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82730 | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.11.0 , < 0.18.0
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
|
| ash-project | ash_typescript |
Affected:
9cade7661a01b6e4d940386f482f48d148dbb1e6 , < aa7f9f1967b0bec806ac1156142267e805d70a55
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/result_processor.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_primitive/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_value_for_json/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_resource_struct/2"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.18.0",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/result_processor.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_primitive/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_value_for_json/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ResultProcessor\u0027:normalize_resource_struct/2"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "aa7f9f1967b0bec806ac1156142267e805d70a55",
"status": "affected",
"version": "9cade7661a01b6e4d940386f482f48d148dbb1e6",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP and relies on Ash field policies to hide attributes on embedded resources that an action returns as a map.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP and relies on Ash field policies to hide attributes on embedded resources that an action returns as a map."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP and relies on Ash field policies to hide attributes on embedded resources that an action returns as a map."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.18.0",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.\u003c/p\u003e\n\u003cp\u003eWhen a field policy denies an attribute, Ash substitutes \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e, which retains the real value in \u003ccode\u003eoriginal_value\u003c/code\u003e because embedded resources must remain writable, and hides it from \u003ccode\u003eInspect\u003c/code\u003e rather than removing it. \u003ccode\u003eAshTypescript.Rpc.ResultProcessor\u003c/code\u003e strips these markers to \u003ccode\u003enil\u003c/code\u003e on its template-driven paths, but \u003ccode\u003enormalize_primitive/1\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/result_processor.ex\u003c/code\u003e had no such clause, so a marker fell through to the generic struct branch which calls \u003ccode\u003eMap.from_struct/1\u003c/code\u003e and serializes every key, \u003ccode\u003eoriginal_value\u003c/code\u003e included. The denied value is returned to the caller inside the marker that represents its own denial.\u003c/p\u003e\n\u003cp\u003eThe simplest trigger is an action returning an embedded resource as a map, which routes through \u003ccode\u003enormalize_resource_struct/2\u003c/code\u003e with an empty template. \u003ccode\u003enormalize_value_for_json/1\u003c/code\u003e is a public, unguarded entry point to the same path.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.11.0 before 0.18.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.\n\nWhen a field policy denies an attribute, Ash substitutes `%Ash.ForbiddenField{}`, which retains the real value in `original_value` because embedded resources must remain writable, and hides it from `Inspect` rather than removing it. `AshTypescript.Rpc.ResultProcessor` strips these markers to `nil` on its template-driven paths, but `normalize_primitive/1` in `lib/ash_typescript/rpc/result_processor.ex` had no such clause, so a marker fell through to the generic struct branch which calls `Map.from_struct/1` and serializes every key, `original_value` included. The denied value is returned to the caller inside the marker that represents its own denial.\n\nThe simplest trigger is an action returning an embedded resource as a map, which routes through `normalize_resource_struct/2` with an empty template. `normalize_value_for_json/1` is a public, unguarded entry point to the same path.\n\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.\n\nWhen a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial.\n\nThe simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path.\n\nThis issue affects ash_typescript: from 0.11.0 before 0.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:09:01.851Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6929-rjmh-4x62"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82730.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82730"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/aa7f9f1967b0bec806ac1156142267e805d70a55"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authorization-redacted field values disclosed through AshTypescript result normalization"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82730",
"datePublished": "2026-09-01T02:09:01.851Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-09-01T02:09:01.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82724 (GCVE-0-2026-82724)
Vulnerability from cvelistv5 – Published: 2026-08-31 03:07 – Updated: 2026-08-31 15:54
VLAI
EPSS
VEX
Title
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
Summary
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.
AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:53 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_phoenix/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82724.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82724 | related |
| https://github.com/ash-project/ash_phoenix/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_phoenix |
Affected:
2.1.26 , < 2.3.25
(semver)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|
| ash-project | ash_phoenix |
Affected:
9a5ea4d377bc263de321d79574872a3dfc4fb541 , < b396e1aa5c6bdec39255f19cf938b539e6d28b71
(git)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82724",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:53:54.952218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:54:49.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/live_view/subdomain_hook.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027:on_mount/4"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "2.1.26",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/live_view/subdomain_hook.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027:on_mount/4"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b396e1aa5c6bdec39255f19cf938b539e6d28b71",
"status": "affected",
"version": "9a5ea4d377bc263de321d79574872a3dfc4fb541",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application uses \u003ccode\u003eAshPhoenix.LiveView.SubdomainHook\u003c/code\u003e with a \u003ccode\u003ehandle_subdomain\u003c/code\u003e callback as a tenant-scoped authorization gate.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application uses `AshPhoenix.LiveView.SubdomainHook` with a `handle_subdomain` callback as a tenant-scoped authorization gate."
}
],
"value": "The application uses AshPhoenix.LiveView.SubdomainHook with a handle_subdomain callback as a tenant-scoped authorization gate."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "2.1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_phoenix invokes the \u003ccode\u003eSubdomainHook\u003c/code\u003e authorization callback with a \u003ccode\u003enil\u003c/code\u003e tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.LiveView.SubdomainHook.on_mount/4\u003c/code\u003e attached a \u003ccode\u003ehandle_params\u003c/code\u003e hook to assign the tenant and then immediately called \u003ccode\u003ehandle_subdomain\u003c/code\u003e in the same \u003ccode\u003eon_mount\u003c/code\u003e. The tenant assign is only written when LiveView later runs \u003ccode\u003ehandle_params\u003c/code\u003e, strictly after \u003ccode\u003eon_mount\u003c/code\u003e returns, so \u003ccode\u003ehandle_subdomain\u003c/code\u003e read an unset assign and ran as \u003ccode\u003eapply(m, f, [socket, nil | a])\u003c/code\u003e. A consumer gate that halts when the user does not belong to the tenant instead evaluated \u003ccode\u003enil\u003c/code\u003e, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs \u003ccode\u003ehandle_subdomain\u003c/code\u003e inside the \u003ccode\u003ehandle_params\u003c/code\u003e hook with the real tenant on every navigation.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the `SubdomainHook` authorization callback with a `nil` tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\n`AshPhoenix.LiveView.SubdomainHook.on_mount/4` attached a `handle_params` hook to assign the tenant and then immediately called `handle_subdomain` in the same `on_mount`. The tenant assign is only written when LiveView later runs `handle_params`, strictly after `on_mount` returns, so `handle_subdomain` read an unset assign and ran as `apply(m, f, [socket, nil | a])`. A consumer gate that halts when the user does not belong to the tenant instead evaluated `nil`, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs `handle_subdomain` inside the `handle_params` hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:07:57.455Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82724.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82724"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/b396e1aa5c6bdec39255f19cf938b539e6d28b71"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82724",
"datePublished": "2026-08-31T03:07:57.455Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T15:54:49.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82634 (GCVE-0-2026-82634)
Vulnerability from cvelistv5 – Published: 2026-08-30 12:34 – Updated: 2026-08-31 16:53
VLAI
EPSS
VEX
Title
Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Summary
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:53 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/pull/40710 | issue-trackingpatch |
| https://github.com/frappe/frappe/commit/37d2eb597… | patch |
| https://github.com/frappe/frappe/blob/0a80046da32… | technical-description |
| https://github.com/frappe/frappe | product |
| https://www.vulncheck.com/advisories/frappe-frame… | third-party-advisory |
Impacted products
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:53:15.895383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:53:42.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "37d2eb59790633da01c741b950cc00ca3558c494",
"status": "affected",
"version": "0a80046da32bb8976cd7854f551c179a4a06b1b3",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Holmquist (Hasp Labs)"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T12:34:52.482Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #40710",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/frappe/frappe/pull/40710"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frappe/frappe/commit/37d2eb59790633da01c741b950cc00ca3558c494"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/0a80046da32bb8976cd7854f551c179a4a06b1b3/frappe/utils/print_format_generator.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/frappe"
},
{
"name": "VulnCheck Advisory: Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-framework-development-branch-incorrect-authorization-via-jinja-template-preview-endpoint"
}
],
"title": "Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82634",
"datePublished": "2026-08-30T12:34:52.482Z",
"dateReserved": "2026-08-30T11:59:07.493Z",
"dateUpdated": "2026-08-31T16:53:42.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82463 (GCVE-0-2026-82463)
Vulnerability from cvelistv5 – Published: 2026-08-29 16:35 – Updated: 2026-08-29 16:35
VLAI
EPSS
VEX
Title
pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
Summary
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pac4j/pac4j/commit/2270c3ff70e… | patch |
| https://www.pac4j.org/blog/security-advisory-pac4… | vendor-advisory |
| https://github.com/pac4j/pac4j/blob/pac4j-parent-… | technical-description |
| https://github.com/pac4j/pac4j | product |
| https://www.vulncheck.com/advisories/pac4j-core-b… | third-party-advisory |
Impacted products
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.pac4j/pac4j-parent",
"product": "pac4j",
"vendor": "pac4j",
"versions": [
{
"lessThan": "6.5.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T16:35:26.904Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e"
},
{
"name": "pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml",
"tags": [
"vendor-advisory"
],
"url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizer.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/pac4j/pac4j"
},
{
"name": "VulnCheck Advisory: pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pac4j-core-before-6.5.6-authorization-bypass-via-reversed-profile-type-check"
}
],
"title": "pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82463",
"datePublished": "2026-08-29T16:35:26.904Z",
"dateReserved": "2026-08-29T14:11:00.955Z",
"dateUpdated": "2026-08-29T16:35:26.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82395 (GCVE-0-2026-82395)
Vulnerability from cvelistv5 – Published: 2026-08-31 21:20 – Updated: 2026-08-31 21:20
VLAI
EPSS
VEX
Title
Sulu: Media move/update authorization bypass (IDOR)
Summary
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/sulu/sulu/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/sulu/sulu/commit/2b959de75d61b… | x_refsource_MISC |
| https://github.com/sulu/sulu/releases/tag/2.6.25 | x_refsource_MISC |
| https://github.com/sulu/sulu/releases/tag/3.0.8 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "sulu",
"vendor": "sulu",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6.25"
},
{
"status": "affected",
"version": "\u003e= 3.0.0-alpha1, \u003c 3.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item\u0027s actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T21:20:58.926Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c"
},
{
"name": "https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793"
},
{
"name": "https://github.com/sulu/sulu/releases/tag/2.6.25",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sulu/sulu/releases/tag/2.6.25"
},
{
"name": "https://github.com/sulu/sulu/releases/tag/3.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sulu/sulu/releases/tag/3.0.8"
}
],
"source": {
"advisory": "GHSA-h6cx-gjxx-v25c",
"discovery": "UNKNOWN"
},
"title": "Sulu: Media move/update authorization bypass (IDOR)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82395",
"datePublished": "2026-08-31T21:20:58.926Z",
"dateReserved": "2026-08-28T22:00:43.512Z",
"dateUpdated": "2026-08-31T21:20:58.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.