Search
Find merged stories by title or summary.
NVD-CVE-2026-81643 - National Institute of Standards and Technology (.gov)
NVD-CVE-2026-81643 National Institute of Standards and Technology (.gov)
cve-2026-81643
Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
CVE-2026-81643 - Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
CVE ID : CVE-2026-81643 Published : Aug. 30, 2026, 6:20 p. m. • 55 minutes ago Description : Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql. Subscription. Batcher, do_send/5 resolves the first notification of a batch and filters it with should_send? /1, which drops results whose errors are coded forbidden or not_found or carry no code, precisely so that unauthorized results are not disclosed. The remaining notifications in the batch are read from the process dictionary, re-run through the pipeline, and appended to the outgoing results without that filter. They reach pubsub. publish_subscription/2, and the not is_nil(record) guard drops only nil records, not error-carrying results.
You've reached the end of current stories for this search.