https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 11:05:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373393 EUVD-2026-373393 https://cve.radiocsirt.org/vuln/euvd-2026-373393 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48042 <p>Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.</p> <p>This issue affects ash: from 0.1.1 before 3.5.39.</p> <p>Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.</p> <p>This issue affects ash: from 0.1.1 before 3.5.39.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48042 https://cve.radiocsirt.org/vuln/ghsa-jj4j-x5ww-cwh9 <p><strong>Affected:</strong> Hex: ash</p> <p>### Summary Certain bulk action calls with a `before_transaction` hook and no `after_transaction` hook, will call the `before_transaction` hook before authorization is checked and a Forbidden error is returned, when called as a bulk action.</p> <p>The impact is that a malicious user could cause a `before_transaction` to run even though they are not authorized to perform the whole action. The `before_action` could run a sensitive/expensive operation.</p> <p>### Impact A malicious user could cause a `before_action` to run even though they are not authorized to perform the whole action.</p> <p>You are affected if you have an create, update or destroy action that:</p> <p>- has a before_transaction hook on it, and no after_transaction hook on it. - is being used via an `Ash.bulk_*` callback (which AshJsonApi and AshGraphql do for update/destroy actions)</p> <p>Whether or not or how much it matters depends on the nature of those before_transaction callbacks. If those before_transaction callbacks are side-effectful, or just doing something like looking up some external data. If your API endpoints are behind authentication and what kind.</p> <p>### Severity</p> <p>The severity for this was hard to gauge. `before_transaction` hooks are not that commonly used. Additionally, any attacker must know which of these things are available to them, be authenticated to make such a request (i.e you very rarely have policies preventing the running of anonymous queries), so privileges and inside knowledge are required. Additionally, the…</p> <p><strong>Affected:</strong> Hex: ash</p> <p>### Summary Certain bulk action calls with a `before_transaction` hook and no `after_transaction` hook, will call the `before_transaction` hook before authorization is checked and a Forbidden error is returned, when called as a bulk action.</p> <p>The impact is that a malicious user could cause a `before_transaction` to run even though they are not authorized to perform the whole action. The `before_action` could run a sensitive/expensive operation.</p> <p>### Impact A malicious user could cause a `before_action` to run even though they are not authorized to perform the whole action.</p> <p>You are affected if you have an create, update or destroy action that:</p> <p>- has a before_transaction hook on it, and no after_transaction hook on it. - is being used via an `Ash.bulk_*` callback (which AshJsonApi and AshGraphql do for update/destroy actions)</p> <p>Whether or not or how much it matters depends on the nature of those before_transaction callbacks. If those before_transaction callbacks are side-effectful, or just doing something like looking up some external data. If your API endpoints are behind authentication and what kind.</p> <p>### Severity</p> <p>The severity for this was hard to gauge. `before_transaction` hooks are not that commonly used. Additionally, any attacker must know which of these things are available to them, be authenticated to make such a request (i.e you very rarely have policies preventing the running of anonymous queries), so privileges and inside knowledge are required. Additionally, the…</p> https://cve.radiocsirt.org/vuln/ghsa-jj4j-x5ww-cwh9