CVE-2026-82747

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible. This issue affects ash: from 3.4.44 before 3.32.2.

• CWE-863

• https://cna.erlef.org/cves/CVE-2026-82747.html
• https://github.com/ash-project/ash/commit/6eddb8ab26e45023faf0c79ebd152bb40aefda02
• https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq
• https://osv.dev/vulnerability/EEF-CVE-2026-82747
• https://github.com/ash-project/ash/security/advisories/GHSA-4259-gvr2-4xhq

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82741Improper Validation of Specified Type of Input vulnerability…2.1
• CVE-2026-82742Uncontrolled Resource Consumption vulnerability in ash-proje…5.9
• CVE-2026-82743Uncontrolled Resource Consumption vulnerability in ash-proje…2.1
• CVE-2026-82744Not Failing Securely (Failing Open) vulnerability in ash-pro…2.1
• CVE-2026-82745Improper Access Control vulnerability in ash-project ash let…5.9
• CVE-2026-82746Missing Authorization vulnerability in ash-project ash allow…5.9
• CVE-2026-82748Incorrect Authorization vulnerability in ash-project ash aut…2.1
• CVE-2026-82749Incorrect Authorization vulnerability in ash-project ash wid…5.9
• CVE-2026-8275A vulnerability was detected in bettercap up to 2.41.5. Affe…3.7
• CVE-2026-8276A flaw has been found in bettercap up to 2.41.5. Affected by…3.7
• CVE-2026-8278Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-82797Uncontrolled Recursion vulnerability in Samsung Open Source …5.5