CVE-2026-82367 - Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
Brief
CVE ID : CVE-2026-82367
Published : Aug. 30, 2026, 7:17 p. m.
- 1 hour, 58 minutes ago
Description : Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic.
AshGraphql. Subscription. Batcher. do_send/5 reads the resolved batch from the process dictionary via Process. get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns.
On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant.