THREAT OPS › Threat News › [NVD] CVE-2026-81316 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary.
AshSql.Aggregate.different
[NVD] CVE-2026-81316 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different
CVE-2026-81316 CVSS: None Published: 2026-08-30T12:17:18.870
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary.
AshSql.Aggregate.different_queries?/2 reports two aggregate queries as different on
Indicators of compromise
- CVE-2026-81316cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-81316