CVE-2026-114214 (GCVE-0-2026-114214)

Vulnerability from cvelistv5 – Published: 2026-10-25 19:47 – Updated: 2026-10-26 14:35
VLAI
Title
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
Summary
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship. This issue affects ash: from 3.24.0 before 3.37.1.
Severity
6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:28 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
EEF CNA under the mitre root
CNA scorecard A 97/100 over 354 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
ash-project ash Affected: 3.24.0 , < 3.37.1 (semver)
    cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Create a notification for this product.
ash-project ash Affected: 24f41e23dcbd9d07cde270a8141490e8f79251f5 , < e37463307304b26bc8fd606322e5c4d8f7f060e5 (git)
    cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Will Townsend Will Townsend Zach Daniel / Ash Project
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T14:28:34.411522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T14:35:21.414Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/read/relationships.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
            },
            {
              "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.37.1",
              "status": "affected",
              "version": "3.24.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/read/relationships.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
            },
            {
              "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
              "status": "affected",
              "version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReachable when a \u003ccode\u003ethrough\u003c/code\u003e relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (\u003ccode\u003eaccessing_from\u003c/code\u003e) or are otherwise open to the caller.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller."
            }
          ],
          "value": "Reachable when a through relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (accessing_from) or are otherwise open to the caller."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.37.1",
                  "versionStartIncluding": "3.24.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Will Townsend"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Will Townsend"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        }
      ],
      "dateAssigned": "2026-10-25T17:24:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a \u003ccode\u003ethrough\u003c/code\u003e relationship.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003ehas_many\u003c/code\u003e relationship declared with \u003ccode\u003ethrough:\u003c/code\u003e was loaded for a single record with a limit of 1, or an unsorted \u003ccode\u003ehas_one\u003c/code\u003e \u003ccode\u003ethrough\u003c/code\u003e relationship was loaded with a limit of 1, \u003ccode\u003elateral_join?/4\u003c/code\u003e in \u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an \u003ccode\u003eoffset\u003c/code\u003e. The read still runs the destination\u0027s policies but carries the relationship as \u003ccode\u003eaccessing_from\u003c/code\u003e, so a client paging such a field (for example \u003ccode\u003eteachers(limit: 1, offset: n)\u003c/code\u003e through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.24.0 before 3.37.1.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination\u0027s policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
            }
          ],
          "value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
                }
              ],
              "value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T19:47:30.612Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Loading a `through` relationship on a single record with `limit: 1` ignores the through path and returns arbitrary destination records",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
        },
        {
          "name": "EEF CNA record for CVE-2026-114214",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-114214",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
        },
        {
          "name": "Introducing commit 24f41e2 in ash-project/ash",
          "tags": [
            "related"
          ],
          "url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
        },
        {
          "name": "Fix commit e374633 in ash-project/ash",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-114214",
    "datePublished": "2026-10-25T19:47:30.612Z",
    "dateReserved": "2026-10-25T14:30:01.870Z",
    "dateUpdated": "2026-10-26T14:35:21.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-114214",
      "date": "2026-11-07",
      "epss": "0.00246",
      "percentile": "0.15938"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
                ],
                "packageName": "ash",
                "packageURL": "pkg:hex/ash",
                "product": "ash",
                "programFiles": [
                  "lib/ash/actions/read/relationships.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
                  },
                  {
                    "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
                  }
                ],
                "repo": "https://github.com/ash-project/ash",
                "vendor": "ash-project",
                "versions": [
                  {
                    "lessThan": "3.37.1",
                    "status": "affected",
                    "version": "3.24.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
                ],
                "packageName": "ash-project/ash",
                "packageURL": "pkg:github/ash-project/ash",
                "product": "ash",
                "programFiles": [
                  "lib/ash/actions/read/relationships.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
                  },
                  {
                    "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
                  }
                ],
                "repo": "https://github.com/ash-project/ash",
                "vendor": "ash-project",
                "versions": [
                  {
                    "lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
                    "status": "affected",
                    "version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
          }
        ],
        "id": "CVE-2026-114214",
        "lastModified": "2026-10-26T15:16:38.597",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-114214",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T14:28:34.411522Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-25T20:16:31.920",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-10-30T07:07:23+00:00",
      "cve": "CVE-2026-114214",
      "id": "CVE-2026-114214",
      "initial_release_date": "2026-10-25T19:47:30.612000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ash: Ash: Information disclosure via missing source filter in relationship queries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114214.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-114214",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-26T14:28:34.411522Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-26T14:32:22.023Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
              ],
              "packageName": "ash",
              "packageURL": "pkg:hex/ash",
              "product": "ash",
              "programFiles": [
                "lib/ash/actions/read/relationships.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
                },
                {
                  "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
                }
              ],
              "repo": "https://github.com/ash-project/ash",
              "vendor": "ash-project",
              "versions": [
                {
                  "lessThan": "3.37.1",
                  "status": "affected",
                  "version": "3.24.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
              ],
              "packageName": "ash-project/ash",
              "packageURL": "pkg:github/ash-project/ash",
              "product": "ash",
              "programFiles": [
                "lib/ash/actions/read/relationships.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
                },
                {
                  "name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
                }
              ],
              "repo": "https://github.com/ash-project/ash",
              "vendor": "ash-project",
              "versions": [
                {
                  "lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
                  "status": "affected",
                  "version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eReachable when a \u003ccode\u003ethrough\u003c/code\u003e relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (\u003ccode\u003eaccessing_from\u003c/code\u003e) or are otherwise open to the caller.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller."
                }
              ],
              "value": "Reachable when a through relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (accessing_from) or are otherwise open to the caller."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.37.1",
                      "versionStartIncluding": "3.24.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Will Townsend"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Will Townsend"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Zach Daniel / Ash Project"
            }
          ],
          "dateAssigned": "2026-10-25T17:24:26.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a \u003ccode\u003ethrough\u003c/code\u003e relationship.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003ehas_many\u003c/code\u003e relationship declared with \u003ccode\u003ethrough:\u003c/code\u003e was loaded for a single record with a limit of 1, or an unsorted \u003ccode\u003ehas_one\u003c/code\u003e \u003ccode\u003ethrough\u003c/code\u003e relationship was loaded with a limit of 1, \u003ccode\u003elateral_join?/4\u003c/code\u003e in \u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an \u003ccode\u003eoffset\u003c/code\u003e. The read still runs the destination\u0027s policies but carries the relationship as \u003ccode\u003eaccessing_from\u003c/code\u003e, so a client paging such a field (for example \u003ccode\u003eteachers(limit: 1, offset: n)\u003c/code\u003e through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.24.0 before 3.37.1.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination\u0027s policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
                }
              ],
              "value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "supportingMedia": [
                    {
                      "base64": false,
                      "type": "text/html",
                      "value": "\u003cp\u003eA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\u003c/p\u003e"
                    },
                    {
                      "base64": false,
                      "type": "text/markdown",
                      "value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
                    }
                  ],
                  "value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863 Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-25T19:47:30.612Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "Loading a `through` relationship on a single record with `limit: 1` ignores the through path and returns arbitrary destination records",
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
            },
            {
              "name": "EEF CNA record for CVE-2026-114214",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-114214",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
            },
            {
              "name": "Introducing commit 24f41e2 in ash-project/ash",
              "tags": [
                "related"
              ],
              "url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
            },
            {
              "name": "Fix commit e374633 in ash-project/ash",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-114214",
        "datePublished": "2026-10-25T19:47:30.612Z",
        "dateReserved": "2026-10-25T14:30:01.870Z",
        "dateUpdated": "2026-10-26T14:35:21.414Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.