CVE-2026-82748: CWE-863 Incorrect Authorization in ash-project ash

The vulnerability arises because Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action. However, when building the data query, the action used can differ from the authorized read_action if an :action option is passed. This causes the aggregate query to run under a potentially more permissive action than the one used for authorization, allowing aggregates (such as counts or sums) to include records that the authorized action's policies would exclude. The fix involves ensuring the aggregate runs under the same read_action it was authorized against. This affects ash versions >=3.5.13 and <3.32.2.

An attacker with access to the aggregate functionality may obtain aggregate data computed over records they are not authorized to read, leading to unauthorized disclosure of information. The impact is limited to data exposure through aggregates and does not allow direct access to individual records. The CVSS score of 2.1 reflects a low severity due to the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by running the aggregate under the same read_action it is authorized against. Until a patch is available, avoid passing differing :action options to aggregate queries or restrict aggregate usage to trusted users.