8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48043

CVE-2025-48043: Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary

When using filter authorization, two edge cases could cause the policy compiler/authorizer to generate a permissive filter:

Bypass policies whose condition can never pass at runtime were compiled as OR(AND(condition, compiled_policies), NOT(condition)). If the condition could never be true at runtime, the NOT(condition) branch evaluated truthy and the overall expression became permissive.
Runtime policy scenarios that reduce to “no checks are applicable” (an empty SAT scenario) were treated as an empty clause and dropped instead of being treated as false, which could again produce an overly broad (permissive) filter.

These bugs could allow reads to return records that should have been excluded by policy.

Impact

Projects that rely on filter-based authorization and define:

bypass ... do ... end blocks whose condition(s) are only resolvable at runtime and can never pass in a given request context, or
runtime checks that simplify to an empty scenario for a clause

may unintentionally generate a permissive query filter, potentially returning unauthorized data.

Actions primarily affected: reads guarded by filter policies. Non-filter (e.g., hard forbid) policies are not impacted.

Technical details

This patch corrects two behaviors:

Ash.Policy.Policy.compile_policy_expression/1 now treats bypass blocks as AND(condition_expression, compiled_policies) instead of OR(AND(...), NOT(condition_expression)). This removes the permissive NOT(condition) escape hatch when a bypass condition never passes.

Miggo Vulnerability Database

→

CVE-2025-48043

CVE-2025-48043:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ash	erlang	< 3.6.2	3.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from two separate flaws in the Ash framework's filter-based authorization logic, which could lead to unauthorized data access. I analyzed the provided patch commit to pinpoint the exact locations of these flaws.

Bypass Policy Flaw in Ash.Policy.Policy.compile_policy_expression/1: The description highlighted that bypass policies with conditions that can never be true at runtime were being miscompiled. The patch for lib/ash/policy/policy.ex confirms this. The original code used an OR condition that included a NOT of the bypass condition. This meant that if the bypass condition was false, the policy would become permissive. The fix introduces a specific check for bypass? and generates a stricter AND expression, removing the vulnerability. The vulnerable function is the private function compile_policy_expression/1 within the Ash.Policy.Policy module.
Empty Scenario Flaw in Ash.Policy.Authorizer: The second issue was that runtime policy scenarios that resulted in no applicable checks were being dropped, again leading to a permissive filter. The patch in lib/ash/policy/authorizer/authorizer.ex shows a new check, if scenario == %{}, which explicitly adds a false condition to the filter. This ensures that an impossible scenario correctly filters out all results. By inspecting the file structure, I identified that this logic resides within the build_filter/2 private function, which is responsible for constructing the final query filter.

Both identified functions are directly involved in processing authorization rules and constructing the data access filters. An exploit would involve a read operation on a resource where a misconfigured authorization policy (either a bypass or a runtime check) triggers one of these flawed logic paths, causing the database query to return more data than the user is authorized to see.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48043: Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary

Impact

Technical details

CVE-2025-48043:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

8.6

8.6

Technical Details

Basic Information

Basic Information

CVE-2025-48043: Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary

Impact

Technical details

Workarounds

How to tell if user is affected

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48043: Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary

Impact

Technical details

CVE-2025-48043:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.6

8.6

Technical Details

Basic Information

Basic Information

CVE-2025-48043: Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary

Impact

Technical details

Workarounds

How to tell if user is affected

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI