A logic flaw in Ash.Policy.Authorizer causes the system to return records that a runtime read policy denies to any actor. The code path that handles empty‑scenario branches mistakenly treats records with no valid policy scenarios as authorized instead of forbidden. Consequently, records that should be inaccessible are delivered to users, exposing sensitive data. This is a classic authorization bypass flaw classified as CWE‑863, leading to a confidentiality breach risk where attackers or misconfigured actors can gain access to data they should not see.

The vulnerability affects the Ash framework from version 3.4.44 up through before 3.32.2. All installations of ash-project:ash that have not been upgraded to 3.32.2 or later are impacted.

The CVSS score of 5.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits as of this analysis. The likely attack vector appears to be any actor who can enact a query that uses a runtime read policy; no special privilege is required beyond access to the application. Because the flaw allows unauthorized data retrieval, the impact is serious for confidentiality, though the exploitation path is straightforward once access to the application is gained.