CVE-2026-114214: ash 3.24.0 to before 3.37.1

Affected technology

ash · 3.24.0 to before 3.37.1
ash-project

ash · 24f41e23dcbd9d07cde270a8141490e8f79251f5 to before e37463307304b26bc8fd606322e5c4d8f7f060e5
ash-project

Component: 'Elixir.Ash.Actions.Read.Relationships'
Function: 'Elixir.Ash.Actions.Read.Relationships':lateral_join?/4, 'Elixir.Ash.Actions.Read.Relationships':load/4
File: lib/ash/actions/read/relationships.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.