PT-2025-42599 · Ash · Ash

Jechol Lee + 2 · Published 2025-10-17 · Updated 2025-10-21 · CVE-2025-48044

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ash versions 3.6.3 through 3.7.1

Description An incorrect authorization issue exists in ash, potentially allowing authentication bypass. The issue is associated with the lib/ash/policy/policy.ex file and the Elixir.Ash.Policy.Policy:expression/2 function.

Recommendations Update to ash version 3.7.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-48044

GHSA-PCXQ-FJP3-R752

Affected Products

Ash

References · 22

• 🔥 https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752 · Exploit
• https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d · Patch
• https://osv.dev/vulnerability/EEF-CVE-2025-48044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48044 · Security Note
• https://osv.dev/vulnerability/GHSA-pcxq-fjp3-r752 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48044 · Vendor Advisory
• https://github.com/ash-project/ash · Note
• https://twitter.com/VulmonFeeds/status/1979197398615314641 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o9vs6p/resumen_diario_de_vulnerabilidades_18102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o9v03c/resumen_diario_de_vulnerabilidades_18102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ob1a2r/resumen_diario_de_vulnerabilidades_19102025 · Reddit Post
• https://cna.erlef.org/cves/CVE-2025-48044.html · Note
• https://t.me/cveNotify/139142 · Telegram Post
• https://twitter.com/fernandokarl/status/1979233099692073024 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1obkvoc/resumen_diario_de_vulnerabilidades_20102025 · Reddit Post