Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic.

AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get(:batchresolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressuresync and :noproc fallbacks dosend/5 runs inline in the publishing caller's process, so if a resolver inside an outer dosend/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batchresolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batchresolved around each run.

This issue affects ashgraphql: from 1.4.0 before 1.11.0.

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions.

The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with runqueries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, so the evaluated policy carries no tenant condition and a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter is true. The single-notification clause has no tenant guard at all, and the batched clause checks only the head of the notification list, so non-head entries authorize purely in memory. A tenant-scoped read is reached only when filter evaluation fails.

This issue affects ashgraphql: from 1.4.0 before 1.11.0.

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact.

In AshGraphql.Errors, each error is passed to the configured errorhandler and the returned map is merged with the pre-handler path via Map.putnew(handled, :path, path). Because putnew defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from builderrorpath/5, which falls back to raw internal Ash attribute and argument names when no fieldnames mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.

This issue affects ashgraphql: from 1.9.0 before 1.11.0.