EEF-CVE-2026-82730

## Summary

Incorrect Authorization vulnerability in ash-project ash\_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.

When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original\_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize\_primitive/1 in lib/ash\_typescript/rpc/result\_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from\_struct/1 and serializes every key, original\_value included. The denied value is returned to the caller inside the marker that represents its own denial.

The simplest trigger is an action returning an embedded resource as a map, which routes through normalize\_resource\_struct/2 with an empty template. normalize\_value\_for\_json/1 is a public, unguarded entry point to the same path.

This issue affects ash\_typescript: from 0.11.0 before 0.18.0.

## Configuration

The application exposes an AshTypescript RPC endpoint over HTTP and relies on Ash field policies to hide attributes on embedded resources that an action returns as a map.