CVE-2025-48044: Authorization bypass when bypass policy condition evaluates to true

Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.

Impact Resources with bypass policies can be accessed without proper authorization when: - Bypass condition evaluates to true - Bypass authorization checks fail - Other policies exist but their conditions don't match

Details Vulnerable code in: lib/ash/policy/policy.ex:69

elixir {%{bypass?: true}, condexpr, completeexpr}, {oneconditionmatches, allpoliciesmatch} -> { b(condexpr or oneconditionmatches), # <- Bug: uses condition only b(completeexpr or allpoliciesmatch) }

The final authorization decision is: oneconditionmatches AND allpoliciesmatch

When a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:

1. oneconditionmatches = condexpr (bypass condition) = true (bug - should check if bypass actually authorizes) 2. allpoliciesmatch = (completeexpr OR NOT condexpr) for each policy - For non-matching policies: (false OR NOT false) = true (policies don't apply) 3. Final: true AND true = true (incorrectly authorized)

The bypass condition alone satisfies "at least one policy applies" even though the bypass fails to authorize.

Fix Replace condexpr with completeexpr on line 69: elixir {%{bypass?: true}, condexpr, completeexpr}, {oneconditionmatches, allpoliciesmatch} -> { b(completeexpr or oneconditionmatches), # <- Fixed b(completeexpr or allpoliciesmatch) }

Line 52 should also be updated for consistency (though it's only triggered when bypass is the last policy, making it coincidentally safe in practice): elixir {%{bypass?: true}, condexpr, completeexpr}, {oneconditionmatches, true} -> { b(completeexpr or oneconditionmatches), # <- For consistency completeexpr }

PoC elixir policies do bypass always() do authorizeif actorattributeequals(:isadmin, true) end

policy actiontype(:read) do authorizeif always() end end

Non-admin user can perform create actions (should be denied).

Test demonstrating the bug: elixir test "bypass policy bug" do policies = [ %Ash.Policy.Policy{ bypass?: true, condition: [{Ash.Policy.Check.Static, result: true}], # condition = true policies: [ %Ash.Policy.Check{ type: :authorizeif, check: {Ash.Policy.Check.Static, result: false}, # policies = false checkmodule: Ash.Policy.Check.Static, checkopts: [result: false] } ] }, %Ash.Policy.Policy{ bypass?: false, condition: [{Ash.Policy.Check.Static, result: false}], policies: [ %Ash.Policy.Check{ type: :authorizeif, check: {Ash.Policy.Check.Static, result: true}, checkmodule: Ash.Policy.Check.Static, checkopts: [result: true] } ] } ]

expression = Ash.Policy.Policy.expression(policies, %{}) assert expression == false # Expected: false (deny) # Actual on main: true (incorrectly authorized) end