AshSql.exists AuthZ Bypass (CVE-2026-77454, CWE-861, Fix 0.7.1)

AshSql 漏洞总结 漏洞概述 漏洞名称： 的 在带有 和 过滤器的关系上会失效，导致授权检查被绕过。 根本原因： 在关系带有 / 且存在 表达式时，会静默地丢弃调用方提供的 ，导致基于该表达式的授权/作用域过滤器失效，使任意关联行都能匹配。 严重等级：中危（CVSS 5.9 / 10） CVE 编号：CVE-2026-77454 CWE：CWE-861 影响范围 受影响版本： 已修复版本： 影响：使用 且关系同时声明 （或 ）和 引用的关系时，授权检查（如 ）可能失效，产生过度宽泛的查询，最严重情况是授权条件消失后检查对任意关联行都通过。 修复方案 升级到 0.7.1 版本。 临时缓解：避免在带 / 的关系上同时使用 过滤器与 ；或显式在 中保留调用方谓词。 POC 代码（完整提取） ```elixir 复现脚本（Elixir） defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_version, do: Version(major: 15, minor: 0, patch: 0) defmodule Poc_Related_Query do use Ash.PoC_Related_Query def min_pg_

目標達成すべての支援者に感謝 — 100%達成しました！

AshSql.exists AuthZ Bypass (CVE-2026-77454, CWE-861, Fix 0.7.1)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

AshSql.exists AuthZ Bypass (CVE-2026-77454, CWE-861, Fix 0.7.1)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！