When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial.
The simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path.
This issue affects ash_typescript: from 0.11.0 before 0.18.0.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_typescript | unaffected |
|
||||||
| ash-project | ash_typescript | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 01 Sep 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial. The simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path. This issue affects ash_typescript: from 0.11.0 before 0.18.0. | |
| Title | Authorization-redacted field values disclosed through AshTypescript result normalization | |
| First Time appeared |
Ash-project
Ash-project ash Typescript |
|
| Weaknesses | CWE-863 | |
| CPEs | cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Typescript |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-09-01T02:09:01.851Z
Reserved: 2026-08-31T00:59:08.960Z
Link: CVE-2026-82730
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-01T03:16:52.787
Modified: 2026-09-01T03:16:52.787
Link: CVE-2026-82730
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-01T03:30:04Z