Skip to content
feed: live
>_ 0dayNews
CVE Record
[ LOW ] CVE-2026-70395

Ash managed relationship lookup bypasses authorization

Ash passes client-supplied lookup values to Ash.Query.filter/2 without type casting in managed belongs_to relationships; a nested map forges filter expressions, enabling unauthorized record access. CVSS 4.0: 2.1 Low.

cat cve-2026-70395.json
Vendor
ash-project
Product
Ash
CVSS
2.1
EPSS (exploit probability)
N/A
Status
patched
Published

When manage_relationship is configured with on_lookup: :relate on a belongs_to relationship, Ash forwards the client-supplied lookup value to Ash.Query.filter/2 before casting it to the declared attribute type. A client submitting a nested map where a scalar is expected causes the framework to treat the map as a filter expression, not a literal ID. This allows an attacker to forge a relationship to a record they cannot legitimately name and to recover the secret value used to look it up — bypassing record-level authorization policies that govern relationship creation but not the lookup path.

The Erlang Ecosystem Foundation CNA scored this CVSS 4.0: 2.1 Low (Local attack vector, Attack Requirements: Present). Despite the low base score, the authorization bypass impacts confidentiality and integrity for any data reachable via affected belongs_to relationships.

Mitigation: Update to a patched Ash release. See the CNA advisory for affected version ranges and the fix commit. NVD entry: CVE-2026-70395.