Auth bypass in Ash-project Ash
CVE-2025-48044
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2. This issue a…
Vulnerability class: Broken Access Control
EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.
Affected products
- Ash-project Ash — versions 3.6.3, 79749c2685ea031ebb2de8cf60cc5edced6a8dd0
Weakness classification (CWE)
References
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, vendor-advisory)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)