CVE-2026-82730: Authorization-redacted field values disclosed through AshTypescript result normalization
Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.
When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in originalvalue because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalizeprimitive/1 in lib/ashtypescript/rpc/resultprocessor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.fromstruct/1 and serializes every key, originalvalue included. The denied value is returned to the caller inside the marker that represents its own denial.
The simplest trigger is an action returning an embedded resource as a map, which routes through normalizeresourcestruct/2 with an empty template. normalizevalueforjson/1 is a public, unguarded entry point to the same path.
This issue affects ashtypescript: from 0.11.0 before 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_typescriptto a version that resolves this vulnerability.Fixed in 0.18.0 - Compensating control
Restrict/disable the AshTypescript RPC endpoint so that unauthorized RPC callers cannot invoke AshTypescript result normalization (e.g., allow only authenticated/authorized clients to reach normalize_value_for_json/1 and the RPC result normalization path).
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using ash_typescript versions from 0.11.0 up to, but not including, 0.18.0 are affected. Exposure requires RPC results to pass through the vulnerable result-normalization path with field-policy-denied attributes.
What does an attacker need to do to obtain a denied value?
An unauthorized RPC caller must invoke a path that returns an embedded resource as a map, which can route through normalization with an empty template. The public, unguarded normalize_value_for_json/1 entry point reaches the same vulnerable path.
What information is disclosed?
A field value denied by an Ash field policy can be serialized inside an Ash.ForbiddenField marker. The marker's original_value field retains the actual denied attribute value and is included when the marker falls through the generic struct serialization branch.
What version resolves the issue?
Upgrade ash_typescript to 0.18.0 or later. Versions before 0.18.0 in the affected range are vulnerable.