CVE-2026-77454: CWE-863 Incorrect Authorization in ash-project ash_sql

The vulnerability arises because AshSql.Join.related_query/3 skips the caller-supplied exists predicate for relationships that have both a limit (or from_many?) and a parent(...) referencing filter or sort. The function limit_from_many/5 then drops both the limit and the predicate, resulting in a bare correlated EXISTS with no predicate. This causes the authorization check to match any record with any related row, effectively bypassing actor-scoping conditions in policies that rely on such expressions. This can lead to unauthorized access when policies depend on these predicates for scoping.

An attacker can bypass authorization filters that rely on exists/2 predicates over certain relationships, potentially gaining access to data or actions they should not be authorized for. This undermines the intended access control policies and can lead to privilege escalation or unauthorized data exposure within applications using affected versions of ash_sql.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor the ash-project advisories for updates and consider implementing additional manual authorization checks as a temporary mitigation.