CVE-2026-82748: Ash Framework Auth Bypass Vulnerability

CVE-2026-82748 Overview

CVE-2026-82748 is an Incorrect Authorization vulnerability [CWE-863] in the ash-project ash Elixir framework. The flaw resides in Ash.Actions.Aggregate, where an aggregate is authorized under one read action but computed under another. When a caller supplies an :action option, the aggregate query runs under that action while authorization was computed against the group's original read_action. If the run action's read policies are more permissive, the aggregate can include records the authorized action would have excluded. This discloses information about data the actor should not be able to read. The issue affects ash from version 3.5.13 before 3.32.2.

Critical Impact

Aggregate values such as counts and sums may reflect records the actor is not authorized to read, leading to information disclosure through mismatched policy evaluation.

Affected Products

• ash-project ash versions >= 3.5.13 and < 3.32.2
• Applications built on the Ash Framework that expose aggregates via read actions
• Elixir services using Ash.Actions.Aggregate with caller-supplied :action options

Discovery Timeline

• 2026-09-01 - CVE-2026-82748 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82748

Vulnerability Analysis

The Ash Framework provides aggregate functions such as counts and sums over resource records. Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} tuple and authorizes each group under the specified read_action. The authorization pass evaluates the policies attached to that read action.

When building the underlying data query, however, the module previously selected the action as opts[:action] || read_action || <primary read>. This creates a divergence between the action whose policies were evaluated and the action whose query actually executes. An aggregate computed this way can traverse records excluded by the authorized action's policies, exposing counts or sums derived from unauthorized data.

Root Cause

The root cause is a mismatch between the action used for authorization and the action used for query execution in lib/ash/actions/aggregate.ex. The opts[:action] override took precedence when constructing the data query but was ignored when computing authorization groups. Any caller passing an :action option with more permissive read policies bypassed the stricter policies of the authorized read_action.

Attack Vector

Exploitation requires local access to code paths that invoke aggregates with a caller-controlled :action option. An actor with permission to run a permissive read action can request an aggregate authorized against a stricter action, receiving aggregate values that reflect records outside the actor's authorized scope. The attack does not require crafted input; only the ability to choose the run action.

     |> Enum.reduce_while({:ok, %{}}, fn
       {{agg_authorize?, read_action}, aggregates}, {:ok, acc} ->
         action =
-          opts[:action] || read_action ||
+          read_action ||
             Ash.Resource.Info.primary_action!(query.resource, :read).name
 
         query =

Source: GitHub Commit 2d9b78b

The patch removes opts[:action] from the action selection so the aggregate always runs under the same read_action used for authorization.

Detection Methods for CVE-2026-82748

Indicators of Compromise

• Application logs showing aggregate queries where the :action option differs from the group's read_action
• Aggregate results whose magnitudes are inconsistent with the actor's expected data scope under the authorized read action
• Unexpected counts or sums returned to callers that lack direct read access to the underlying records

Detection Strategies

• Perform a source code review for calls to Ash.aggregate/* and related APIs that pass an :action option alongside aggregates that specify read_action
• Add instrumentation around Ash.Actions.Aggregate to log both the authorized read_action and the executed action, and alert on divergence
• Compare deployed ash dependency versions against 3.32.2 using dependency inventory or SBOM tooling

Monitoring Recommendations

• Ingest Elixir application and Ash policy logs into a centralized log platform and monitor for aggregate authorization anomalies
• Track dependency versions across build pipelines and flag any service still using ash in the vulnerable range >= 3.5.13, < 3.32.2
• Review audit trails for read actions that historically diverged between authorization and execution paths

How to Mitigate CVE-2026-82748

Immediate Actions Required

• Upgrade ash to version 3.32.2 or later in all Elixir services that depend on the framework
• Audit application code for callers that pass :action options into aggregate operations and validate that policies align with intended scope
• Rebuild and redeploy affected services after upgrading, ensuring lockfiles reflect the patched version

Patch Information

The fix is committed in GitHub Commit 2d9b78b and released in ash3.32.2. Details are published in the GitHub Security Advisory GHSA-g5hp-mghm-3mgp and the CNA CVE-2026-82748 Record. Additional metadata is available in the OSV Vulnerability EEF-CVE-2026-82748 entry.

Workarounds

• Remove or restrict caller-supplied :action overrides on aggregate operations until upgrading is possible
• Align read action policies so that any action reachable via aggregates enforces at least the constraints of the strictest authorized read action
• Restrict aggregate-exposing endpoints to actors whose broader read policies already cover the aggregated data

# Update ash to the patched release in mix.exs
# {:ash, "~> 3.32.2"}
mix deps.update ash
mix deps.get
mix compile --force