These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-80223 record describes an Incorrect Authorization vulnerability in ash_graphql, a component of the ash-project. This vulnerability allows an authenticated subscriber in one tenant to receive records from another tenant over GraphQL subscriptions due to improper authorization in the subscription resolver. The issue arises from the resolver's fast path, which calls Ash.can/3 with run_queries?: [truncated]
The CVE-2026-78693 vulnerability in ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. This issue arises from how error handling is implemented in AshGraphql.Errors, where each error is passed to the configured error_handler and the returned map is merged with the pre-handler path. If the error_handler returns a fresh map or deletes [truncated]
A Deserialization of Untrusted Data vulnerability exists in ash-project ash_cloak, allowing an attacker to crash the BEAM node by triggering unbounded atom creation or a decompression bomb during decryption. The issue affects ash_cloak versions from 0.1.0 before 0.4.0. This vulnerability can be triggered by influencing the bytes of an encrypted column, which can lead to a denial of service attack. The vul [truncated]
The CVE-2026-78699 record describes an Unchecked Return Value vulnerability in ash_postgres. This vulnerability allows a user with the ability to rename a tenant to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, potentially gaining access to its data. The issue arises from the AshPostgres.MultiTenancy.rename_tenant/3 function [truncated]
The CVE-2026-81316 record indicates an Incorrect Authorization vulnerability in ash-project ash_sql, allowing disclosure of aggregate values across authorization or tenancy boundaries due to inadequate filter checks in aggregate queries. This issue affects ash_sql versions from 0.1.0 before 0.7.1. The vulnerability arises from AshSql.Aggregate.different_queries?/2 reporting two aggregate queries as differ [truncated]
PatchSiren debrief on CVE-2026-80227, an Incorrect Comparison vulnerability in ash-project ash_sql. The issue allows users to bypass trimmed uniqueness or equality checks in the database by padding string fields with specific characters. This vulnerability arises from the incorrect implementation of string_trim/1 in ash_sql, which fails to remove all types of whitespace characters, unlike String.trim/1 in [truncated]
The CVE-2026-78691 vulnerability, classified as an Improper Neutralization of Special Elements in Data Query Logic issue in ash_sql, allows users to inject live SQL LIKE wildcards. This can lead to unauthorized data access or query manipulation. The vulnerability affects ash_sql versions from 0.1.1-rc.10 before 0.7.1 and has a CVSS score of 2.1, classified as LOW severity. Users and administrators of ash_ [truncated]
The CVE-2026-77454 vulnerability in ash_sql allows a caller to bypass scoping or authorization filters expressed as exists/2 over a relationship that declares both a limit and a parent-referencing filter or sort. This occurs because AshSql.Join.related_query/3 skips the caller-supplied exists predicate for such relationships, delegating it to limit_from_many/5, which can drop both the limit and the predic [truncated]
The CVE-2026-77846 vulnerability, classified as Improper Neutralization of Special Elements in Data Query Logic, affects ash_sqlite versions from 0.1.2-rc.0 before 0.2.18. An attacker controlling a get_path/2 segment can traverse into nested JSON, disclosing private or sensitive embedded fields. AshSqlite.SqlImplementation constructs the SQLite json_extract path using $. <> Enum.join(right, .), allowing a [truncated]
The ash_paper_trail library, used for versioning and change tracking in applications, contains a Cleartext Storage of Sensitive Information vulnerability. This issue arises because the :redact and :ignore actions in ash_paper_trail only protect top-level attributes of the tracked resource, leaving sensitive data in embedded resources, unions, or lists exposed in cleartext within version resources. Develop [truncated]
PatchSiren debrief on CVE-2026-77831 based on the supplied source corpus. The CVE record was published on 2026-08-30T01:20:29.597Z and has not been modified since then. This vulnerability, classified as an Inefficient Algorithmic Complexity issue, affects ash_paper_trail, specifically versions from 0.1.1 before 0.7.0. The vulnerability allows a user who can submit a large array attribute to a paper-traile [truncated]
The CVE-2026-75847 vulnerability, classified as Cleartext Storage of Sensitive Information, affects the ash_paper_trail library. This issue arises from AshPaperTrail.Resource.Transformers.CreateVersionResource deriving sensitivity from an ignore_attributes list that defaults to empty, leading to unintended exposure of sensitive attributes in public version resources. The vulnerability enables unauthorized [truncated]
The CVE-2026-70395 vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name and recover the secret value used to look it up. This is due to improper neutralization of special elements in data query logic when manage_relationship is used with on_lookup: :relate on a belongs_to relationship. The issue affects ash versions from 1.52.0-rc.11 before 3.31.1. Users [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-09T18:16:43.627Z and has not been modified since then. This Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. The vulnerability affects ash versions from 1.17.0 before 3.31.1. Developers and [truncated]
CVE-2026-55736 is an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash. The issue allows a user to set the value of a private action argument intended to be controlled only by trusted server-side code. This occurs because Ash filters out private arguments incompletely when building a changeset from a parameter map. Specifically, private argumen [truncated]