CVE-2026-114214

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

View on CVE.org

Published Oct 25, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.

When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.

This issue affects ash: from 3.24.0 before 3.37.1.

Analysis

Technical impact

A bug in the ash library causes a through relationship that is limited to one record to ignore the through path and return arbitrary destination records. This results in an authorization flaw that lets an authenticated client read records that should be inaccessible when accessed through the destination relationship. The flaw can be exploited to enumerate valid destination records via normal API calls, potentially leaking sensitive data.

Affected Systems

The vulnerability affects the open‑source Ash framework from version 3.24.0 up to but not including 3.37.1. Systems using these Ash releases, particularly those exposing relationships through GraphQL or similar APIs, are at risk.

Risk and Exploitability

With a CVSS score of 6, the vulnerability is considered moderate severity. The EPSS score is < 1%, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires legitimate authentication and the ability to issue a query that loads a through relationship with a limit of one. An attacker can then enumerate destination records that policies permit when accessed through the relationship, but only after the initial leak of the first record. The lack of explicit restrictions on the relationship load path makes the flaw straightforward to trigger for any user with privilege to read the source entity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ash-project

ash

unaffected

Version	Status	Constraints
`3.24.0`	affected	< 3.37.1

ash-project

ash

unaffected

Version	Status	Constraints
`24f41e23dcbd9d07cde270a8141490e8f79251f5`	affected	< e37463307304b26bc8fd606322e5c4d8f7f060e5

No data.

Vendor Product Versions

Ash-project

Ash

Version	Status	Scheme	Platform
`[3.24.0,3.37.1)`	affected	semver	—

Ash-project

Ash

Version	Status	Scheme	Platform
`[24f41e23dcbd9d07cde270a8141490e8f79251f5,e37463307304b26bc8fd606322e5c4d8f7f060e5)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Ash to version 3.37.1 or later to apply the vendor fix for the through relationship limit bug.
Ensure any GraphQL or API queries that load relationships with limits have proper source‑record filtering and consider disabling the use of limits on through relationships until further verification.
Review your system’s policy enforcement to confirm that policies bound to destination records do not inadvertently expose sensitive data through other relationships.

Generated by OpenCVE AI on October 30, 2026 at 14:49 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.246% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-114214.html
https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5
https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5
https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863
https://nvd.nist.gov/vuln/detail/CVE-2026-114214
https://osv.dev/vulnerability/EEF-CVE-2026-114214
https://www.cve.org/CVERecord?id=CVE-2026-114214

History

Oct 30, 2026 12:30 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-639
References		https://nvd.nist.gov/vuln/detail/CVE-2026-114214 https://www.cve.org/CVERecord?id=CVE-2026-114214
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Oct 26, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship. This issue affects ash: from 3.24.0 before 3.37.1.
Title		Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
First Time appeared		Ash-project Ash-project ash
Weaknesses		CWE-863
CPEs		cpe:2.3:a:ash-project:ash::::::::
Vendors & Products		Ash-project Ash-project ash
References		https://cna.erlef.org/cves/CVE-2026-114214.html https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5 https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5 https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863 https://osv.dev/vulnerability/EEF-CVE-2026-114214
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`