Search
Find merged stories by title or summary.
CVE-2026-82367 - Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
CVE ID : CVE-2026-82367 Published : Aug. 30, 2026, 7:17 p. m. • 1 hour, 58 minutes ago Description : Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql. Subscription. Batcher. do_send/5 reads the resolved batch from the process dictionary via Process. get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant.
cve-2026-82367
Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
You've reached the end of current stories for this search.