CVE-2026-82730: CWE-863 Incorrect Authorization in ash-project ash_typescript

The vulnerability in ash_typescript occurs because when a field policy denies access to an attribute, Ash replaces it with a %Ash.ForbiddenField{} marker that retains the real attribute value in an internal field called original_value. While some result processing paths strip this marker to nil, the normalize_primitive/1 function in lib/ash_typescript/rpc/result_processor.ex lacks a clause to handle this marker properly. As a result, the marker is treated as a generic struct and serialized with Map.from_struct/1, exposing the original denied value to unauthorized RPC callers. This can be triggered by actions returning embedded resources as maps or by calling the public normalize_value_for_json/1 function. The affected versions are ash_typescript 0.11.0 through versions before 0.18.0.

Unauthorized remote procedure call (RPC) clients can read attribute values that Ash field policies explicitly deny, potentially exposing sensitive data that should be hidden. This bypass of authorization controls compromises data confidentiality in affected versions of ash_typescript.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a fix is available, avoid exposing embedded resources as maps via RPC or using unguarded entry points like normalize_value_for_json/1 that may trigger this vulnerability.