CVE-2026-101028
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
Published Oct 9, 2026 · updated Oct 9, 2026
## Summary Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via , and . ( ) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example ) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through , an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. and its page counts are not affected. This issue affects ash: from 2.6.0 before 3.34.6. ## Configurations Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into , or (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 9, 2026 · GitHub Advisory Database
Detected
## Summary Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via , and . ( ) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example ) or through an aggregate o
Oct 9, 2026 · GitHub Advisory Database
Fix available
ash fixed in 3.34.6
Oct 9, 2026 · GitHub Advisory Database
Fix available
ash fixed in 3.34.6
Oct 9, 2026 · GitHub Advisory Database
Updated
## Summary Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via , and . ( ) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example ) or through an aggregate o
Affected
- Hex ash2.6.0 → 3.34.6
Sources
- CVE.orgVulnerability recordCVE-2026-101028
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-xj24-8f5c-pp5p
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryEEF-CVE-2026-101028
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
osv.dev