CVE-2026-78216: AshLua Information Disclosure Vulnerability

CVE-2026-78216 Overview

CVE-2026-78216 affects AshLua (ash_lua), an Elixir library that exposes Ash Framework read actions to Lua scripts executed through an eval action. The vulnerability allows a Lua script to bypass Ash field policies by reading restricted fields as aggregate operations. A read call accepts operations such as list, min, max, first, sum, and avg that build an ad-hoc Ash.Query.Aggregate over a named field. While Ash field policies normally redact forbidden fields on returned records with %Ash.ForbiddenField{}, this redaction did not apply to aggregate values. The flaw is classified under [CWE-1220: Insufficient Granularity of Access Control].

Critical Impact
Attackers with script execution privileges can exfiltrate sensitive personally identifiable information (PII) and other per-actor restricted fields by requesting them as aggregates rather than direct field reads.

Affected Products

ash_lua versions 0.1.0 through 0.2.1
Elixir applications using the Ash Framework with AshLua for scripted read actions
Fixed in ash_lua version 0.2.2

Discovery Timeline

2026-09-08 - CVE-2026-78216 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78216

Vulnerability Analysis

AshLua allows Lua scripts to invoke Ash read actions with aggregate operations over a named field. The runtime builds an Ash.Query.Aggregate on demand and returns the raw aggregated value to the calling script. Ash field policies enforce per-actor authorization by redacting forbidden fields on returned records, replacing values with the %Ash.ForbiddenField{} sentinel. That redaction path only covers direct field selection on returned records and does not intercept values produced through aggregate calculations.

A script running under an actor whose field policy forbids a field can request the same field as an aggregate operation. The aggregate executes at the datastore level and returns the raw value, bypassing the policy check entirely. This exposes fields marked public? true but restricted by per-actor field policies, including sensitive PII columns.

Root Cause

The underlying defect is a missing authorization axis. Prior hardening in AshLua enforced the exposed-field allow-list controlling field visibility. Field visibility and per-actor field-policy authorization are separate controls. The aggregate execution path in lib/ash_lua/runtime.ex never called into the field policy authorization layer, so any field reachable through an aggregate call was returned without policy evaluation.

Attack Vector

Exploitation requires network-adjacent access with privileges to submit a Lua script to an eval action. The attacker constructs a script that invokes an aggregate operation, such as list or first, against a policy-restricted field on an accessible resource. The aggregate returns the raw values across rows the actor can otherwise read, effectively disclosing forbidden field data.

The upstream fix authorizes aggregated fields on the read operation path by passing authorize_fields?: true to the query pipeline. Source: GitHub Commit 266a5d

elixir

      |> maybe_limit(limit)
      |> maybe_offset(offset)

-    perform_operation(query, resource, operation, opts)
+    perform_operation(query, resource, operation, Keyword.put(opts, :authorize_fields?, true))
  end

  defp perform_operation(query, _resource, "count", opts) do

Detection Methods for CVE-2026-78216

Indicators of Compromise

Lua eval action invocations that call aggregate operations (list, min, max, first, sum, avg) against fields flagged as sensitive or protected by field policies.
Application logs showing repeated aggregate queries by a single actor across many resources or fields.
Query telemetry showing aggregate reads on columns typically returned as %Ash.ForbiddenField{} for the same actor.

Detection Strategies

Instrument the Ash query pipeline to log every aggregate operation initiated from AshLua with the actor identity, resource, field, and operation.
Compare aggregate access patterns against the resource's field policy definitions to flag aggregates over fields the actor cannot read directly.
Alert on Lua scripts that iterate over resources and fields programmatically, particularly loops that enumerate field names.

Monitoring Recommendations

Track versions of ash_lua deployed across services and alert on any release older than 0.2.2.
Ingest Elixir application logs and Ash telemetry events into a centralized data lake for correlation with authentication and actor context.
Baseline normal Lua eval workloads and alert on new or unusual aggregate operations against PII-bearing resources.

How to Mitigate CVE-2026-78216

Immediate Actions Required

Upgrade ash_lua to version 0.2.2 or later in every application that exposes eval actions to untrusted or lower-privileged actors.
Audit Ash resources for fields marked public? true and restricted by field policies, and confirm those fields are no longer readable via aggregate calls.
Review Lua scripts and stored eval payloads for aggregate operations targeting sensitive fields.

Patch Information

The fix ships in ash_lua 0.2.2. It authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. See the GitHub Security Advisory GHSA-5whv-8rcp-x33j and the CNA CVE-2026-78216 Entry for advisory details.

Workarounds

Restrict eval action access to trusted actors with administrator-level privileges until the patch is applied.
Remove or narrow the exposed-field allow-list in AshLua configuration to exclude fields governed by per-actor field policies.
Disable aggregate operations in scripted read paths where a code-level fork is feasible, pending upgrade to 0.2.2.

bash

# Update ash_lua dependency in mix.exs
# {:ash_lua, "~> 0.2.2"}
mix deps.update ash_lua
mix deps.get
mix compile