Skip to content
OpenAdvisories

Package · Hex

ash_graphql

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-81643

    Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

    Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, do_send/5 resolves the first notification of a batch and filters it …

    ash-project ash_graphql ash_graphql Hex
  • Low 2.3
    CVE-2026-82367

    Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

    Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionar…

    ash-project ash_graphql ash_graphql Hex