Threat Intelligence Database

CVE-2026-77454 is an incorrect authorization vulnerability in the ash-project's ash_sql library. It allows bypassing of authorization filters when a relationship declares both a limit (or from_many?) and a parent-referencing filter or sort. This causes the authorization check to be skipped, potentially allowing unauthorized access. The issue affects versions from 0.4.1 up to but not including 0.7.1.

CVE-2026-81316 is an incorrect authorization vulnerability in ash-project's ash_sql component. It allows an attacker to receive aggregate values computed over data that should have been excluded by more restrictive filters, potentially disclosing sensitive aggregated information across authorization or tenancy boundaries. The issue arises because aggregate queries are considered identical if their filters differ but their sort criteria do not, leading to reuse of aggregate results from broader queries for narrower ones. This affects ash_sql versions from 0.1.0 up to but not including 0.7.1.

CVE-2026-81318 is an incorrect authorization vulnerability in ash-project's ash_sql library affecting versions from 0.1.0 up to but not including 0.7.1. The flaw allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's data due to improper query rebuilding that loses tenant schema context. This results in aggregates being computed against the wrong tenant's rows. The vulnerability has a low severity score and no known exploits or official patches at this time.

CVE-2026-78691 is a vulnerability in ash-project's ash_sql component where improper neutralization of special elements in SQL LIKE query logic allows an attacker to inject live SQL LIKE wildcards. This occurs because the escaping mechanism does not properly escape backslashes, enabling attackers to manipulate pattern matching. The vulnerability affects versions from 0.1.1-rc.10 before 0.7.1 of ash_sql. The CVSS score is low, indicating limited impact.

CVE-2026-80227 is an incorrect comparison vulnerability in ash-project's ash_sql component. It arises because the string_trim/1 function compiles to SQL that only removes literal spaces, unlike Elixir's String.trim/1 which removes all whitespace characters including tabs, newlines, carriage returns, and form feeds. This discrepancy allows padded strings with certain whitespace characters to pass trimmed uniqueness or equality checks in the database but fail in memory, or vice versa. This can cause near-duplicate values or bypass trimmed comparisons in filters, validations, or identities relying on string_trim/1.