The vulnerability arises from a flaw in the authorizer module of the Ash framework, where runtime policies that should never pass are incorrectly applied, allowing an attacker to bypass authentication checks. This flaw precisely maps to CWE‑863, highlighting a failure in authorization logic that permits unauthorized users to gain access to protected resources, potentially leading to data exposure or privilege escalation. As the bypass occurs at the authorization layer, the impact is primarily integrity and confidentiality, with the attacker able to act as a legitimate user without proper credentials.

Glance the Ash framework released before v3.6.2, specifically any installation using the package versions before 3.6.2 or the commit 66d81300065b970da0d2f4528354835d2418c7ae. The vendor is ash‑project and the product in question is the Ash package distributed via Hex.

The CVSS score of 8.6 signals a high severity vulnerability, yet the EPSS score indicates a very low probability of exploitation at present (<1%). Because the flaw is a pure authorization bypass, an attacker would need to craft requests that trigger the flawed strict_filters logic or exploit unauthenticated endpoints. The issue is not yet present in the CISA KEV catalog, so no known exploit code has been reported publicly. The likely attack vector is inferred to be through exposed API endpoints or custom policy definitions that include impossible filter conditions, enabling the attacker to bypass authentication without additional privileges.