CVE-2026-82749: CWE-863 Incorrect Authorization in ash-project ash

The vulnerability arises in ash-project ash when the function resolve_parent_in_filter/3 resolves an unresolvable parent reference to nil instead of failing. This behavior causes scoping predicates that rely on parent(...) references to incorrectly match records where the parent field is missing or not selected, effectively widening the scope and returning unauthorized records. For example, a filter like org_id == parent(org_id) becomes an IS NULL match, activating unrestricted branches in guards such as is_nil(parent(org_id)) or org_id == parent(org_id). The vulnerability affects versions from 3.13.2 before 3.32.2. The remediation is to fail the read operation with an error when the parent(...) reference cannot be resolved, preventing unintended data exposure.

This vulnerability can lead to unauthorized data access by returning records that should have been excluded by the scoping filter. The incorrect authorization widens the scope of data returned in relationships, potentially exposing sensitive or restricted information. The impact is rated medium with a CVSS score of 5.9, indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix is to fail the read operation with an error when a parent(...) reference cannot be resolved instead of defaulting to nil. Until an official patch or update is available, users should review their usage of parent(...) references in filters and consider workarounds to avoid unresolved parent references. Monitor vendor communications for an official fix.