A mis‑evaluation of policy conditions in the Ash framework causes the system to treat a request as authenticated when the bypass condition evaluates to true, granting access to protected resources without legitimate credentials. This unauthorized access can lead to privilege escalation and compromise of both confidentiality and integrity. The weakness is classified as CWE‑863, reflecting incorrect or incomplete authorization checks.

The vulnerability applies to the Ash framework produced by the ash-project. Versions 3.6.3 through 3.7.0, inclusive, are affected. Earlier releases before 3.6.3 are not impacted. Deployments running any of these affected versions should be considered vulnerable until an update is applied.

With a CVSS score of 8.6 the vulnerability carries a high impact, yet the EPSS score of < 1 % suggests a low current chance of exploitation. The issue is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be an application‑level trigger that evaluates the policy expression; an attacker who can influence that evaluation—through crafted input or configuration—can bypass authentication without user interaction, making the flaw valuable for attackers.