This vulnerability (CVE-2025-48043) in ash-project ash involves incorrect authorization checks in the authorizer module (lib/ash/policy/authorizer/authorizer.ex), particularly in the Elixir.Ash.Policy.Authorizer strict_filters/2 function. It allows an attacker with limited privileges to bypass authentication controls, potentially gaining unauthorized access. The affected versions are all releases before 3.6.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation could allow an attacker to bypass authentication mechanisms, leading to unauthorized access to protected resources or functionality within the ash software. This could compromise confidentiality and integrity of data or operations governed by the authorization logic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor the ash-project's official channels for updates and apply any released patches promptly once available.