Skip to content
OpenAdvisories
High · 7.1 CVE-2025-48042 EEF-CVE-2025-48042EUVD-2025-27096GHSA-jj4j-x5ww-cwh9

Before action hooks may execute in certain scenarios despite a request being forbidden

Published Sep 7, 2025 · Updated Sep 22, 2026 · Assigned by EEF

Vendor: ash-project Product: ash Package: ash Ecosystem: Hex

Description

Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects ash: from 0.1.1 before 3.5.39.

Affected products

VendorProductAffectedFixed
ash-project ash 0.1.1 – < 3.5.39 3.5.39

Affected packages

EcosystemPackageAffectedFixedRecord
Hex ash >= 0.1.1, < 3.5.39 3.5.39 EEF-CVE-2025-48042
Hex ash < 3.5.39 3.5.39 GHSA-jj4j-x5ww-cwh9

References