EEF-CVE-2026-82586 CVE-2026-82586 GHSA-37jv-wc37-fhcw
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.52%
- Chance of exploitation in the next 30 days. Higher than 44.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-424 Improper Protection of Alternate Path
- Fix
0.2.1- Upgrade ash_lua to this version or later
Description
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.
AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.
This issue affects ash_lua: from 0.1.0 before 0.2.1.
Configurations
Reachable only when an application exposes AshLua scripting (the AshLua.Resource / AshLua.Domain extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_lua | >= 0.1.0, < 0.2.1 |
0.2.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_lua Hex → 0.2.1
- mix
{:ash_lua, "~> 0.2.1"} # then: mix deps.update ash_lua
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-424: Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
How to prevent it
- Architecture and Design: Deploy different layers of protection to implement security in depth.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates | Not rated yet | Also affects ash_lua |
| EEF-CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | Not rated yet | Same weakness, CWE-424 |
| GHSA-25gq-j9jx-43pg Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | Medium | Same weakness, CWE-424 |
| GHSA-263q-5cv3-xq9g Gitea allows attackers to add attachments with forbidden file extensions | Medium | Same weakness, CWE-424 |
| GHSA-ggwg-cmwp-46r5 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key | Critical Known exploited | Same weakness, CWE-424 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor