CVE-2026-81643 - Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
Brief
CVE ID : CVE-2026-81643
Published : Aug. 30, 2026, 6:20 p. m.
- 55 minutes ago
Description : Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see.
In AshGraphql. Subscription. Batcher, do_send/5 resolves the first notification of a batch and filters it with should_send? /1, which drops results whose errors are coded forbidden or not_found or carry no code, precisely so that unauthorized results are not disclosed.
The remaining notifications in the batch are read from the process dictionary, re-run through the pipeline, and appended to the outgoing results without that filter. They reach pubsub. publish_subscription/2, and the not is_nil(record) guard drops only nil records, not error-carrying results.