CVE-2026-82730 | CVSS: N/A
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.
When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to t
参考链接:
• https://cna.erlef.org/cves/CVE-2026-82730.html
• https://github.com/ash-project/ash_typescript/commit/aa7f9f1967b0bec806ac1156142
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6929-rjmh
📌 数据来源: NVD 官方