Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82730— Authorization-redacted field values disclosed through AshTypescript result normalization

Quick assessment

Affected
ash-project ash_typescript
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： ash-project 中的 ash_typescript 存在“授权不当”漏洞，允许未经授权的 RPC 调用者读取被 Ash 字段策略（field policy）禁止访问的属性值。 当字段策略禁止访问某个属性时，Ash 会用 替换该属性。该结构体在 中保留了真实值（因为嵌入资源需要保持可写性），并对其进行隐藏，而不是直接移除。AshTypescript.Rpc.ResultProcessor 在其模板驱动路径中会将这些标记（marker）去除（设为 nil），但位于 中的 函数缺少对

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1079
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82730

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Authorization-redacted field values disclosed through AshTypescript result normalization
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial. The simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path. This issue affects ash_typescript: from 0.11.0 before 0.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_typescript 0.11.0 ~ 0.18.0 cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
ash-project ash_typescript 9cade7661a01b6e4d940386f482f48d148dbb1e6 ~ aa7f9f1967b0bec806ac1156142267e805d70a55 cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82730

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82730

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82730 (1)

Vendor Advisories for CVE-2026-82730 (3)

Same Patch Batch · ash-project · 2026-09-01 · 23 CVEs total

CVE-2026-74837 8.7 HIGH Unbounded atom creation from client-supplied RPC field names in AshTypescript field format
CVE-2026-77856 8.2 HIGH Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-77950 6.3 MEDIUM RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-82732 6.3 MEDIUM Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82733 6.3 MEDIUM Route handler return value echoed into AshTypescript error response
CVE-2026-82738 5.9 MEDIUM Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of
CVE-2026-82735 5.9 MEDIUM Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82737 5.9 MEDIUM Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting
CVE-2026-82747 5.9 MEDIUM Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82742 5.9 MEDIUM Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships,
CVE-2026-82745 5.9 MEDIUM ETS and Mnesia data layers overwrite an existing record on create instead of enforcing pri
CVE-2026-82746 5.9 MEDIUM Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to for
CVE-2026-82749 5.9 MEDIUM Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is
CVE-2026-82731 2.3 LOW Unescaped path parameters in AshTypescript generated TypeScript client allow request redir
CVE-2026-82740 2.1 LOW Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82739 2.1 LOW Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic misma
CVE-2026-82741 2.1 LOW Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82736 2.1 LOW Ash.Type.CiString validates length and match constraints before case folding, allowing con
CVE-2026-82743 2.1 LOW Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82734 2.1 LOW Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ash_typescript
Same vendor: ash-project
Same weakness: CWE-863

V. Comments for CVE-2026-82730

No comments yet

Leave a comment