ash-project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-96581 Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's High 7.6 · Oct 26, 2026
• CVE-2026-94201 Ash stores :atom-typed attributes as strings and compares them as strings.High 8.2 · Oct 5, 2026
• CVE-2026-82753 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaustHigh 8.2 · Sep 7, 2026
• CVE-2026-82586 Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-fielHigh 8.2 · Sep 7, 2026
• CVE-2026-82730 Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.High 8.2 · Aug 31, 2026
• CVE-2026-77856 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom tabHigh 8.2 · Aug 31, 2026
• CVE-2026-74837 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom tabHigh 8.7 · Aug 31, 2026
• CVE-2026-82724 Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access cheHigh 7.6 · Aug 31, 2026
• CVE-2026-82722 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM aHigh 8.3 · Aug 30, 2026
• CVE-2026-82673 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to High 8.3 · Aug 30, 2026
• CVE-2026-77850 Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.High 8.4 · Aug 30, 2026
• CVE-2026-75757 Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind anHigh 8.3 · Aug 30, 2026
• CVE-2026-82564 Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy recordsHigh 7.1 · Aug 30, 2026
• CVE-2026-75760 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-faciHigh 7.1 · Aug 30, 2026
• CVE-2026-81315 Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-siteHigh 7.4 · Aug 30, 2026
• CVE-2026-77956 Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir High 8.9 · Aug 30, 2026
• CVE-2026-81636 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL High 8.7 · Aug 30, 2026
• CVE-2026-80223 Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphHigh 7.1 · Aug 30, 2026
• CVE-2026-78699 Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's sHigh 7.2 · Aug 30, 2026
• CVE-2026-67579 Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagiHigh 7.5 · Aug 12, 2026
• CVE-2026-34593 Ash Framework is a declarative, extensible framework for building Elixir applications.High 8.2 · Apr 2, 2026
• CVE-2025-48044 Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass.High 8.6 · Oct 17, 2025
• CVE-2025-48043 Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass.High 8.6 · Oct 10, 2025
• CVE-2025-48042 Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.High 7.1 · Sep 7, 2025