Description
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary.

AshSql.Aggregate.different_queries?/2 reports two aggregate queries as different only when their filter and their sort both differ. Aggregate queries rarely carry a sort, so two aggregates that share a name but carry entirely different filters compare as identical. The colliding aggregate keeps its name and is treated as already computed, and select_aggregates returns the first-registered variant's value. The same name reaches the builder twice with different filters when actor or tenant context is stamped into each aggregate's query, so a narrowly filtered aggregate can be served the value of a previously registered broad one.

This issue affects ash_sql: from 0.1.0 before 0.7.1.
Published: 2026-08-30
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in ash_sql causes two aggregate queries with the same name but different filters to be treated as identical. The first aggregate registered is returned for subsequent requests, allowing a narrow filter to return a value computed over a broader set of rows. This leads to counts, sums, or lists being revealed across tenancy or authorization boundaries, effectively bypassing intended access controls and exposing sensitive data.

Affected Systems

The affected product is ash_sql from the ash-project. Versions from 0.1.0 up to, but not including, 0.7.1 are impacted.

Risk and Exploitability

The CVSS score is 2.1, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an application user or client that can submit aggregate queries with duplicate names and varying filters. Exploitation requires the ability to configure aggregate names within the application, which may be possible via API or user interface, enabling an attacker to retrieve aggregated data they should not have access to. While the probability of exploitation is low and there is no remote code execution, the confidentiality impact warrants remediation.

Generated by OpenCVE AI on August 30, 2026 at 13:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ash_sql to version 0.7.1 or newer.
  • Rename or uniquely scope aggregate names to prevent collisions between tenants or authorization contexts.
  • Add validation logic to reject aggregate queries that would clash with existing ones for the same user or tenant, ensuring each aggregate name is unique per authorization scope.

Generated by OpenCVE AI on August 30, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different_queries?/2 reports two aggregate queries as different only when their filter and their sort both differ. Aggregate queries rarely carry a sort, so two aggregates that share a name but carry entirely different filters compare as identical. The colliding aggregate keeps its name and is treated as already computed, and select_aggregates returns the first-registered variant's value. The same name reaches the builder twice with different filters when actor or tenant context is stamped into each aggregate's query, so a narrowly filtered aggregate can be served the value of a previously registered broad one. This issue affects ash_sql: from 0.1.0 before 0.7.1.
Title Same-named aggregates with differing filters are conflated in AshSql
First Time appeared Ash-project
Ash-project ash Sql
Weaknesses CWE-863
CPEs cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Sql
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Sql
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-30T11:59:41.945Z

Reserved: 2026-08-29T23:30:01.223Z

Link: CVE-2026-81316

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T12:17:18.870

Modified: 2026-08-30T12:17:18.870

Link: CVE-2026-81316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T13:30:05Z

Weaknesses