AshSql.exists AuthZ Bypass (CVE-2026-77454, CWE-861, Fix 0.7.1)

AshSql Vulnerability Summary Vulnerability Overview Vulnerability Name: on fails on relations with and filters, resulting in authorization checks being bypassed. Root Cause: When a relation has a / and contains a expression, silently discards the provided by the caller. This causes authorization/scoping filters based on that expression to become ineffective, allowing any related row to match. Severity: Medium (CVSS 5.9 / 10) CVE ID: CVE-2026-77454 CWE: CWE-861 Scope of Impact Affected Versions: Fixed Version: Impact: When using on a relation that declares both (or ) and a reference, authorization checks (e.g., ) may fail, resulting in overly broad queries. In the worst case, once the authorization condition is dropped, the check passes for any related row. Fix Upgrade to version 0.7.1. Temporary mitigation: Avoid using filters together with on relations with / ; or explicitly retain the caller's predicate within the . POC Code (Full Extraction) ```elixir Reproduction script (Elixir) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC

Goal Reached Thanks to every supporter — we hit 100%!

AshSql.exists AuthZ Bypass (CVE-2026-77454, CWE-861, Fix 0.7.1)

More from this source