CVE-2026-82586: CWE-424 Improper Protection of Alternate Path in ash-project ash_lua

The vulnerability in ash_lua (versions >=0.1.0 <0.2.1) involves improper protection of alternate paths (CWE-424) where the read action's operation aggregate path uses String.to_existing_atom and Ash.Query.Aggregate.new! to resolve field names directly from Lua calls without enforcing the exposed-field allow-list. Consequently, a user-supplied Lua script can access any attribute of readable records, including sensitive private fields such as hashed_password. This flaw allows unauthorized data disclosure if an attacker can submit or influence Lua scripts executed by the system.

An attacker able to submit or influence Lua scripts can read any attribute of any record accessible to the actor, including private sensitive fields like hashed passwords. This leads to unauthorized disclosure of sensitive data, potentially compromising user credentials or other confidential information. The vulnerability does not require privileges or user interaction but does require the ability to submit or influence Lua scripts.

No explicit patch or fix is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable the ability for untrusted users to submit or influence Lua scripts in ash_lua environments to prevent exploitation.