Description
Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions.

The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with run_queries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, so the evaluated policy carries no tenant condition and a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter is true. The single-notification clause has no tenant guard at all, and the batched clause checks only the head of the notification list, so non-head entries authorize purely in memory. A tenant-scoped read is reached only when filter evaluation fails.

This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Published: 2026-08-30
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑tenant data disclosure via GraphQL subscriptions
Action: Patch Now
AI Analysis

Impact

The vulnerability arises from an incorrect authorization check in the GraphQL subscription resolver of ash‑graphql. The resolver authorizes each notification payload in memory by evaluating the read policy filter without applying a tenant guard. Because multitenancy is only applied at query‑build time, an authenticated subscriber in one tenant can receive records that belong to a different tenant whenever the policy filter evaluates to true. This issue is an Authorization Bypass (CWE‑863) and allows cross‑tenant data disclosure.

Affected Systems

ash‑project’s ash_graphql is affected. All releases from 1.4.0 up to, but not including, 1.11.0 are vulnerable. Newer releases, beginning with 1.11.0, contain the fix.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate‑to‑high risk. The exploit requires an authenticated user in one tenant who initiates a GraphQL subscription. Because the authorization is performed in memory without a tenant check, the attacker can receive a tenant‑B record when subscribed to tenant‑A notifications. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of tenant‑scoped filtering makes the impact significant for any multi‑tenant deployment.

Generated by OpenCVE AI on August 30, 2026 at 19:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash‑graphql to version 1.11.0 or later to apply the vendor fix.
  • If an upgrade is not immediately possible, modify the subscription resolver or policy filters to include an explicit tenant guard so that each notification checks the tenant scope before delivery.
  • As an interim control, consider disabling GraphQL subscriptions for users in tenants that are not fully trusted until the patch can be applied.

Generated by OpenCVE AI on August 30, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 30 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Description Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with run_queries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, so the evaluated policy carries no tenant condition and a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter is true. The single-notification clause has no tenant guard at all, and the batched clause checks only the head of the notification list, so non-head entries authorize purely in memory. A tenant-scoped read is reached only when filter evaluation fails. This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Title Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
First Time appeared Ash-project
Ash-project ash Graphql
Weaknesses CWE-863
CPEs cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Graphql
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Graphql
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T15:58:00.640Z

Reserved: 2026-08-30T15:30:02.097Z

Link: CVE-2026-80223

cve-icon Vulnrichment

Updated: 2026-08-31T15:57:52.879Z

cve-icon NVD

Status : Deferred

Published: 2026-08-30T19:17:29.220

Modified: 2026-09-03T05:15:17.610

Link: CVE-2026-80223

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:22:31Z

Weaknesses