The Ash framework contains incorrect authorization logic that permits authentication bypass. An attacker can exploit this flaw to gain unintended access to protected resources, potentially escalating privileges and compromising confidentiality and integrity. The issue is identified as CWE‑863, indicating improper authorization checks.

The vulnerability applies to the Ash framework produced by the ash-project. Versions 3.6.3 through 3.7.0, inclusive, are affected. Earlier releases before 3.6.3 are not impacted. Deployments running any of these affected versions should be considered vulnerable until an update is applied.

With a CVSS score of 8.6 the vulnerability carries a high impact, yet the EPSS score of < 1 % suggests a low current chance of exploitation. The issue is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be an application‑level trigger that evaluates the policy expression; an attacker who can influence that evaluation—through crafted input or configuration—can bypass authentication without user interaction, making the flaw valuable for attackers.