EUVD-2026-373394

fkie_cve-2025-48044

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass.

This issue affects ash: from 3.6.3 before 3.7.1.

GHSA-pcxq-fjp3-r752 — Ash has authorization bypass when bypass policy condition evaluates to true

Affected: Hex: ash

### Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.

### Impact Resources with bypass policies can be accessed without proper authorization when: - Bypass condition evaluates to true - Bypass authorization checks fail - Other policies exist but their conditions don't match

### Details Vulnerable code in: [lib/ash/policy/policy.ex:69](https://github.com/ash-project/ash/blob/b2e4d625/lib/ash/policy/policy.ex#L69)

```elixir {%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} -> { b(cond_expr or one_condition_matches), # <- Bug: uses condition only b(complete_expr or all_policies_match) } ```

The final authorization decision is: `one_condition_matches AND all_policies_match`

When a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:

1. **one_condition_matches** = `cond_expr` (bypass condition) = **true** (bug - should check if bypass actually authorizes) 2. **all_policies_match** = `(complete_expr OR NOT cond_expr)` for each policy - For non-matching policies: `(false OR NOT false)` = **true** (policies don't apply) 3. **Final**: `true AND true` = **true** (incorrectly authorized)

The bypass condition alone satisfies "at least one policy applies" even though the bypass fails to authorize.

### Fix Replace `cond_expr` with `complete_expr` on line 69: ```elixir…

Most recent entries from all

EUVD-2026-373394

fkie_cve-2025-48044

GHSA-pcxq-fjp3-r752 — Ash has authorization bypass when bypass policy condition evaluates to true