Skip to content
Log inStart free trial

EEF-CVE-2026-82367 CVE-2026-82367 GHSA-wm4m-cjmc-5v8c

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Not rated yet Hex
Severity
0.0 / 10
Unknown · CVSS 4.0
Exploit chance (EPSS)
0.39%
Chance of exploitation in the next 30 days. Higher than 33.66% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-488 Exposure of Data Element to Wrong Session
Fix
1.11.0
Upgrade ash_graphql to this version or later

Description

Summary

Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic.

AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run.

This issue affects ash_graphql: from 1.4.0 before 1.11.0.

Configurations

The application uses ash_graphql subscriptions where a subscription resolver's execution can itself emit an Ash notification, and delivery takes the synchronous :backpressure_sync or :noproc (missing-batcher) path rather than a library-owned task.

Affected versions

Hex

PackageVulnerableFixed in
ash_graphql
>= 1.4.0, < 1.11.0
1.11.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ash_graphql Hex → 1.11.0

mix
{:ash_graphql, "~> 1.11.0"} # then: mix deps.update ash_graphql

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
High
Attack requirements
Present
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
None
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-488: Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

How to prevent it
  • Architecture and Design: Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
  • Testing: Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
  • Architecture and Design: In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-78693
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Not rated yet Also affects ash_graphql
EEF-CVE-2026-80223
Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
Not rated yet Also affects ash_graphql
EEF-CVE-2026-81636
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
Not rated yet Also affects ash_graphql
EEF-CVE-2026-81633
Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
Not rated yet Also affects ash_graphql
EEF-CVE-2026-81643
Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
Not rated yet Also affects ash_graphql
GHSA-c476-6w5q-jw77
rclone: FTP cross-session auth-proxy backend confusion
High Same weakness, CWE-488
GHSA-f23p-vx2j-j53r
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Medium Same weakness, CWE-488
GHSA-9h85-g7w3-rh49
ViewComponent: Reused Component Instances Retain Stale Render Context
Medium Same weakness, CWE-488

Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor