EEF-CVE-2026-82749
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
Quick fix
EEF-CVE-2026-82749 — ash: upgrade to the fixed version with the command below.
mix deps.update ashDetails
## Summary
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.
Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve\_parent\_in\_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org\_id == parent(org\_id) then becomes an IS NULL match, and a guard like is\_nil(parent(org\_id)) or org\_id == parent(org\_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.
This issue affects ash: from 3.13.2 before 3.32.2.
Are you affected?
Enter the version of the package you're using.