AshLua allows Lua scripts to perform read actions that include aggregate operations (list, min, max, first, sum, avg) over named fields. While Ash field policies redact forbidden fields on returned records, this redaction does not apply to aggregate values. Consequently, a script can access fields restricted by per-actor field policies by requesting aggregates instead of direct field reads. This includes fields marked public? true but restricted by actor-specific policies, such as sensitive personally identifiable information (PII). The vulnerability affects ash_lua versions from 0.1.0 before 0.2.2. The patch authorizes aggregated fields against resource field policies, refusing or scoping aggregates to visible rows only.

An actor with limited read permissions can bypass per-actor field policy restrictions by requesting aggregate values of forbidden fields, potentially exposing sensitive data such as PII that should be redacted. This undermines the intended access control granularity and could lead to unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix enforces authorization of aggregated fields against field policies, preventing unauthorized aggregate reads. Users should upgrade to ash_lua version 0.2.2 or later once available. Until then, restrict Lua script eval actions or limit actor permissions to minimize exposure.