Get real-time updates on Telegram
CVE-2025-48043: ash 0.1.1 to before 3.6.2
CVE-2025-48043. EPSS 0.00386 (percentile 0.31157), scored 19-Oct-2026.
Affected technology
ash · 0.1.1 to before 3.6.2
ash-project
ash · 4c41344126b0aba09ec3085517000f8aefec299e to before 66d81300065b970da0d2f4528354835d2418c7ae
ash-project
Component: 'Elixir.Ash.Policy.Authorizer'
Function: 'Elixir.Ash.Policy.Authorizer':strict_filters/2
File: lib/ash/policy/authorizer/authorizer.ex
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
The source reports that an attacker could get past authentication checks. Source advisory’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.
- CWE
- CWE-863
- CCR priority
- 0.1 /100 (P5)
- EPSS
- 0.00386 · percentile 0.31157 · 2026-10-19
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-19 17:57:47.606446+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-48043.html