CVE-2026-78216: AshLua eval read operations can read field-policy-protected fields via aggregates
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ashlua: from 0.1.0 before 0.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash_luato a version that resolves this vulnerability.Fixed in 0.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to run a Lua script through an AshLua eval action and must be able to invoke an affected Ash read action. The impact is limited to fields that the caller is forbidden to read by field policies but that can be requested through the aggregate operation.
Are fields protected only by per-actor field policies at risk?
Yes. Affected fields can be public? true and still be restricted for particular actors by a field policy. The existing exposed-field allow-list checks field visibility, but it does not enforce per-actor field-policy authorization for aggregate results.
Which versions are affected and what fixes the issue?
ash_lua versions from 0.1.0 before 0.2.2 are affected. Version 0.2.2 authorizes aggregated fields against the resource field policies, refusing access or limiting aggregation to rows where the field is visible.
What can be done before upgrading?
Restrict access to Lua eval actions and to read actions that scripts can invoke, particularly where those actions permit aggregate operations over sensitive fields. Review fields protected by per-actor field policies, including PII, because record-level redaction does not protect their raw aggregate values in affected versions.