CVE-2026-80223 ash-project CVE debrief

Who should care

Users of ash_graphql, especially those with multi-tenant setups, should be aware of this vulnerability and take steps to mitigate it. This includes organizations using ash_graphql versions between 1.4.0 and 1.11.0, who should prioritize patching to prevent unauthorized access to records across different tenants. Affected operator, platform, vulnerability-management, and security-team impact should be carefully reviewed to ensure proper mitigation and exposure review. Compensating controls for exposed systems and monitoring for suspicious activity across tenant boundaries are also recommended while remediation is scheduled and verified. Asset inventory and rollback/change windows should be considered for exposed assets that need extra review. Source tracking and exceptions, retest remediated assets, and close the item only after evidence is documented are also crucial steps to take in response to this vulnerability. The CVE record was published on 2026-08-30T19:17:29.220Z and has not been modified since then, emphasizing the need for immediate attention to this issue. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. The single-notification clause lacks a tenant guard, and the batched clause only checks the head of the notification list, leading to purely in-memory authorization for non-head entries. A tenant-scoped read is reached only when filter evaluation fails. This issue affects ash_graphql: from 1.4.0 before 1.11.0. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with run_queries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies mult

Technical summary

The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory with a fast path that calls Ash.can/3 with run_queries?: false. This evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 without issuing a query. As Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, the evaluated policy lacks a tenant condition. Consequently, a tenant-B notification can be routed to a tenant-A subscriber if the policy filter is true. The single-notification clause lacks a tenant guard, and the batched clause only checks the head of the notification list, leading to purely in-memory authorization for non-head entries.

Defensive priority

Organizations using ash_graphql versions between 1.4.0 and 1.11.0 should prioritize patching to prevent unauthorized access to records across different tenants.

Recommended defensive actions

• Patch ash_graphql to version 1.11.0 or later
• Restrict access to GraphQL subscriptions for sensitive data
• Monitor for suspicious activity across tenant boundaries
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-80223 issue arises from an Incorrect Authorization vulnerability in ash_graphql, allowing an authenticated subscriber in one tenant to receive records from another tenant over GraphQL subscriptions due to improper authorization in the subscription resolver.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.