The vulnerability arises from a flaw in the AshSql query builder where the exists/2 predicate is silently omitted for relationships that combine a limit (or from_many?) with a parent(...) filter or sort. When such a relationship backs a policy, the authorization condition is removed, causing the policy to evaluate as true for any actor that has any related row. This results in a direct authorization bypass that can give unauthorized users access to protected resources.

Affected versions are ash_sql from 0.4.1 up to, but not including, 0.7.1. All installations of the library in this range are potentially vulnerable if they rely on exists/2 predicates over limited relationships with parent filters within their authorization logic.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires construction of a query that relies on the omitted exists predicate, typically through policy definitions or application code that uses the affected pattern. Based on the description, it is inferred that the flaw operates at the query generation level, so an attacker must be able to influence query construction or have access to the policy system. The likely attack vector is therefore through development or privileged user access, though the impact is significant once the bypass is achieved.