CVE-2026-81316: CWE-863 Incorrect Authorization in ash-project ash_sql

The vulnerability in ash_sql involves the function AshSql.Aggregate.different_queries?/2, which only treats two aggregate queries as different if both their filter and sort differ. Since aggregate queries rarely include sorting, queries with the same name but different filters are treated as identical. This causes the system to reuse the aggregate result from the first registered query, which may have a broader filter, for subsequent queries with narrower filters. Consequently, an attacker can obtain aggregate data that should have been restricted by authorization or tenancy boundaries. This affects ash_sql versions >=0.1.0 and <0.7.1.

An attacker can receive aggregate values (counts, sums, or lists) computed over data sets that should have been excluded by authorization or tenancy filters. This leads to unauthorized disclosure of aggregated information across boundaries that should enforce data separation. The CVSS 4.0 score is low (2.1), reflecting limited impact and the requirement for local access (AV:L) and partial attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users of affected versions (>=0.1.0 <0.7.1) should monitor vendor communications for patches or updates addressing this authorization flaw.