CVE-2026-82747: CWE-863 Incorrect Authorization in ash-project ash

The vulnerability in ash-project ash arises from improper handling of runtime read policies in the authorization logic. Specifically, in the function check_result/1 within lib/ash/policy/authorizer/authorizer.ex, when all authorization scenarios for a record are impossible (meaning no policy authorizes the record), the code incorrectly returns the record as authorized rather than forbidding it. This results in records that should be denied by the runtime read policy being exposed to any actor. The fix involves forbidding records whose authorization scenarios are all impossible. The affected versions are from 3.4.44 before 3.32.2.

Any actor querying the system can receive records that should have been denied by the runtime read policy, potentially exposing sensitive data that the policy intended to protect. This incorrect authorization undermines access control guarantees of the ash framework, leading to unauthorized data disclosure. The impact is limited to local access vectors (AV:L) and requires low attack complexity, but no privileges or user interaction are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor the ash-project advisories for updates and apply any forthcoming patches that correct the authorization logic. Until a fix is available, carefully review and restrict access to systems using affected versions to mitigate unauthorized data exposure.