The vulnerability arises when the manage_relationship function is used with on_lookup: :relate on a belongs_to relationship. The client-supplied lookup value is passed directly to Ash.Query.filter/2 without casting to the attribute type, allowing a nested map where a scalar is expected to be treated as a filter predicate. This transforms a lookup for a specific record into a query for any record matching a condition. Additionally, the absence of Ash.Query.limit(1) allows Ash.read_one/2 to differentiate between no match, one match, or multiple matches, effectively turning comparison predicates into an oracle to recover the secret lookup value. Despite this, authorization policies on the destination read remain enforced.

An attacker can forge relationships to records without knowing their exact identifiers and recover secret values used in lookups. However, authorization policies still apply, preventing unauthorized data access beyond what the policy allows. The impact is limited by the low CVSS score of 2.1 and the fact that the vulnerability requires local access (AV:L) and partial attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should review usage of manage_relationship with on_lookup: :relate on belongs_to relationships and avoid passing untrusted nested map data as lookup values. Authorization policies remain effective and provide some protection.