Ash managed relationship lookup bypasses authorization
Ash passes client-supplied lookup values to Ash.Query.filter/2 without type casting in managed belongs_to relationships; a nested map forges filter expressions, enabling unauthorized record access. CVSS 4.0: 2.1 Low.
- Vendor
- ash-project
- Product
- Ash
- CVSS
- 2.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
When manage_relationship is configured with on_lookup: :relate on a belongs_to relationship, Ash forwards the client-supplied lookup value to Ash.Query.filter/2 before casting it to the declared attribute type. A client submitting a nested map where a scalar is expected causes the framework to treat the map as a filter expression, not a literal ID. This allows an attacker to forge a relationship to a record they cannot legitimately name and to recover the secret value used to look it up — bypassing record-level authorization policies that govern relationship creation but not the lookup path.
The Erlang Ecosystem Foundation CNA scored this CVSS 4.0: 2.1 Low (Local attack vector, Attack Requirements: Present). Despite the low base score, the authorization bypass impacts confidentiality and integrity for any data reachable via affected belongs_to relationships.
Mitigation: Update to a patched Ash release. See the CNA advisory for affected version ranges and the fix commit. NVD entry: CVE-2026-70395.
