THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-77454 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit (or from_many?) and a parent(...)-referencing filter or sort. AshSql.Join.related_query/3

[NVD] CVE-2026-77454 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit (or from_many?) and a parent(...)-referencing filter or sort. AshSql.Join.related_query/3

mednvdPublished 2026-08-30

CVE-2026-77454 CVSS: None Published: 2026-08-30T12:17:17.273

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit (or from_many?) and a parent(...)-referencing filter or sort.

AshSql.Join.related_query/3 skips the caller-supplied exists predicate for such rela

Indicators of compromise

CVE-2026-77454cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-77454