CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
Attackers can bypass field-level security policies in AshAi to read sensitive data by using aggregate queries, exposing protected fields to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78230?
CVE-2026-78230 is a medium-severity missing authorization vulnerability in ash-project ash_ai, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Weakness: CWE-1220
Which versions are affected by CVE-2026-78230?
1 open source package ship an affected version, including ash_ai.
| Package | Affected | Fixed in |
|---|---|---|
ash_ai Hex | From 0.1.0 | 1.0.3 |
How do I fix CVE-2026-78230?
Upgrade ash_ai to 1.0.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-78230 being exploited?
There is no known exploitation of CVE-2026-78230 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-78230, GHSA-v5rw-36x5-r5vx.