Skip to content
OpenAdvisories

Package · Hex

ash_graphql

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-80223

    Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

    Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notifica…

    ash-project ash_graphql ash_graphql Hex
  • High 8.7
    CVE-2026-81636

    Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

    Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query_comp…

    ash-project ash_graphql ash_graphql Hex