This vulnerability in ash-project ash (versions 3.6.3 before 3.7.1) is caused by incorrect authorization logic in the policy.ex file, specifically in the Elixir.Ash.Policy.Policy module's expression/2 function. This flaw enables an attacker with limited privileges to bypass authentication controls, potentially gaining unauthorized access. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability is tracked as CWE-863 (Incorrect Authorization). No patch or official fix details are currently available.

Successful exploitation could allow an attacker to bypass authentication mechanisms, leading to unauthorized access to protected resources or functionality within applications using the affected ash versions. This could compromise confidentiality and integrity of data or operations relying on the ash policy enforcement. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented in the provided data.