The vulnerability causes a relationship filter that references a parent record to resolve an unresolvable parent reference to nil instead of failing. When a filter condition such as org_id == parent(org_id) is used, the comparison becomes an IS NULL match, which satisfies the predicate and opens the scope to all records. As a result, a user can retrieve records that should have been excluded by the scopes, effectively leaking sensitive data. This flaw is an incorrect authorization weakness (CWE-863) with potential to compromise confidentiality of scoped records.

The issue affects the Ash project’s Ash web framework. Versions 3.13.2 through 3.32.1 (inclusive) are impacted, while 3.32.2 and later contain the fix that causes the read to fail when a parent reference cannot be resolved.

With a CVSS score of 5.9, the vulnerability is considered moderate. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack surface likely involves an authenticated user or an attacker who can construct a request to the framework’s API. By sending a query that includes an unresolved parent(...) reference, the attacker can trigger the widened filter and access records outside the intended scope. The lack of a mitigated error path in affected versions allows the exploit to succeed without additional prerequisites.