The vulnerability is an Incorrect Authorization flaw in the Ash framework that allows Authentication Bypass. It originates in the strict_filters/2 routine located in lib/ash/policy/authorizer/authorizer.ex, where requests are incorrectly permitted even when runtime policies containing impossible filter conditions are present.

All Ash framework releases from version 0.1.0 up to, but not including, 3.6.2 distributed via Hex by ash‑project are affected.

The CVSS score of 8.6 signals high severity, yet the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, meaning no public exploits are known. The likely attack vector is inferred to be through exposed API endpoints or custom policy definitions that employ impossible filter conditions, allowing an attacker to bypass authentication without additional privileges.