Vulnerability-Lookup

CVE-2026-82748 (GCVE-0-2026-82748)

Vulnerability from cvelistv5 – Published: 2026-09-01 03:52 – Updated: 2026-09-01 03:52

Title

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Summary

Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against. Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against. This issue affects ash: from 3.5.13 before 3.32.2.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/ash/security/advis…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82748.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-82748	related
https://github.com/ash-project/ash/commit/2d9b78b…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ash-project	ash	Affected: 3.5.13 , < 3.32.2 (semver) cpe:2.3:a:ash-project:ash::::::::
ash-project	ash	Affected: d2e99980380cad610dbab3c4167e85323244bc71 , < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7 (git) cpe:2.3:a:ash-project:ash::::::::

Credits

Jonatan Männchen / EEF Zach Daniel / Ash Project Peter Ullrich Peter Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Aggregate\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "3.5.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Aggregate\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "2d9b78b87d2dc72885a8aa1d660b478d42f749f7",
              "status": "affected",
              "version": "d2e99980380cad610dbab3c4167e85323244bc71",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "versionStartIncluding": "3.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate\u003c/code\u003e groups aggregates by their \u003ccode\u003e{authorize?, read_action}\u003c/code\u003e and authorizes each group under that read action, but when building the data query it selected the action as \u003ccode\u003eopts[:action] || read_action || \u0026lt;primary read\u0026gt;\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e). When a caller passed an \u003ccode\u003e:action\u003c/code\u003e option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own \u003ccode\u003eread_action\u003c/code\u003e. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same \u003ccode\u003eread_action\u003c/code\u003e it is authorized against.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.13 before 3.32.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\n`Ash.Actions.Aggregate` groups aggregates by their `{authorize?, read_action}` and authorizes each group under that read action, but when building the data query it selected the action as `opts[:action] || read_action || \u003cprimary read\u003e` (`lib/ash/actions/aggregate.ex`). When a caller passed an `:action` option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own `read_action`. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same `read_action` it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
            }
          ],
          "value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T03:52:01.686Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82748.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82748"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82748",
    "datePublished": "2026-09-01T03:52:01.686Z",
    "dateReserved": "2026-08-31T01:00:09.774Z",
    "dateUpdated": "2026-09-01T03:52:01.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82748",
      "date": "2026-09-01",
      "epss": "0.0012",
      "percentile": "0.02012"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82748\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T04:18:05.143\",\"lastModified\":\"2026-09-01T04:18:05.143\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\\n\\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\\n\\nThis issue affects ash: from 3.5.13 before 3.32.2.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Actions.Aggregate\u0027\"],\"programFiles\":[\"lib/ash/actions/aggregate.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:hex/ash\",\"versions\":[{\"version\":\"3.5.13\",\"lessThan\":\"3.32.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Actions.Aggregate\u0027\"],\"programFiles\":[\"lib/ash/actions/aggregate.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:github/ash-project/ash\",\"versions\":[{\"version\":\"d2e99980380cad610dbab3c4167e85323244bc71\",\"lessThan\":\"2d9b78b87d2dc72885a8aa1d660b478d42f749f7\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82748.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82748\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}"
  }
}

FKIE_CVE-2026-82748

Vulnerability from fkie_nvd - Published: 2026-09-01 04:18 - Updated: 2026-09-01 04:18

Severity

2.1 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-82748.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-82748

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Aggregate\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "3.5.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Actions.Aggregate\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "2d9b78b87d2dc72885a8aa1d660b478d42f749f7",
              "status": "affected",
              "version": "d2e99980380cad610dbab3c4167e85323244bc71",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against.\n\nAsh.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || \u003cprimary read\u003e (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group\u0027s own read_action. If the run action\u0027s read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action\u0027s policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against.\n\nThis issue affects ash: from 3.5.13 before 3.32.2."
    }
  ],
  "id": "CVE-2026-82748",
  "lastModified": "2026-09-01T04:18:05.143",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-01T04:18:05.143",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-82748.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/commit/2d9b78b87d2dc72885a8aa1d660b478d42f749f7"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-g5hp-mghm-3mgp"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82748"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82748 (GCVE-0-2026-82748)

FKIE_CVE-2026-82748

Tags

Sightings

Nomenclature