{"id":"EEF-CVE-2026-114214","summary":"Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records","details":"## Summary\n\nIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination's policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1.\n\n## Impact\n\nA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\n\n## Configurations\n\nReachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource's read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller.","aliases":["CVE-2026-114214","GHSA-g2h4-xp57-q863"],"modified":"2026-10-25T20:11:06.823175904Z","published":"2026-10-25T19:47:30.612Z","database_specific":{"cpe_ids":["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-863"],"capec_ids":["CAPEC-1"]},"references":[{"type":"ADVISORY","url":"https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-114214.html"},{"type":"WEB","url":"https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"},{"type":"FIX","url":"https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash"}],"affected":[{"package":{"name":"ash","ecosystem":"Hex","purl":"pkg:hex/ash"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.24.0"},{"fixed":"3.37.1"}]}],"versions":["3.24.0","3.24.1","3.24.2","3.24.3","3.24.4","3.24.5","3.24.6","3.24.7","3.25.0","3.25.1","3.25.2","3.26.0","3.27.0","3.27.1","3.27.2","3.27.3","3.27.4","3.27.5","3.27.6","3.27.7","3.27.8","3.28.0","3.29.0","3.29.1","3.29.2","3.29.3","3.30.0","3.30.1","3.31.0","3.31.1","3.31.2","3.31.3","3.32.0","3.32.1","3.32.2","3.32.3","3.33.0","3.33.1","3.33.10","3.33.11","3.33.2","3.33.3","3.33.4","3.33.5","3.33.6","3.33.7","3.33.8","3.33.9","3.34.0","3.34.1","3.34.2","3.34.3","3.34.4","3.34.5","3.34.6","3.35.0","3.36.0","3.36.1","3.37.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-114214.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/ash","events":[{"introduced":"24f41e23dcbd9d07cde270a8141490e8f79251f5"},{"fixed":"e37463307304b26bc8fd606322e5c4d8f7f060e5"}]}],"versions":["v3.37.0","v3.36.1","v3.36.0","v3.35.0","v3.34.6","v3.34.5","v3.34.4","v3.34.3","v3.34.2","v3.34.1","v3.34.0","v3.33.11","v3.33.10","v3.33.9","v3.33.7","v3.33.6","v3.33.5","v3.33.4","v3.33.3","v3.33.2","v3.33.1","v3.32.3","v3.32.2","v3.32.1","v3.31.3","v3.31.2","v3.31.1","v3.31.0","v3.30.1","v3.30.0","v3.29.3","v3.29.2","v3.29.1","v3.29.0","v3.28.0","v3.27.8","v3.27.7","v3.27.6","v3.27.4","v3.27.3","v3.27.2","v3.27.1","v3.27.0","v3.26.0","v3.25.2","v3.25.1","v3.25.0","v3.24.7","v3.24.6","v3.24.5","v3.24.4","v3.24.3","v3.24.2","v3.24.1","v3.24.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-114214.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"Will Townsend","type":"FINDER"},{"name":"Will Townsend","type":"REPORTER"},{"name":"Zach Daniel / Ash Project","type":"REMEDIATION_DEVELOPER"}]}