CVE-2026-114214
Description
A flaw was found in Ash. This vulnerability allows an authenticated attacker to access unauthorized records, resulting in information disclosure. When querying associated data through intermediate relationships with a limit of one, the framework fails to apply the filter linking destination records to the source record. Consequently, an attacker can paginate through query results to enumerate and read sensitive data that should not be accessible.
Statement
This vulnerability is rated as having Moderate impact for Red Hat because exploitation requires authenticated API access to specific through-relationship queries and results in information disclosure without affecting system integrity or availability. The Ash framework is not included or supported in Red Hat Enterprise Linux or other Red Hat enterprise products. Consequently, default enterprise deployments are not exposed to this flaw, which is restricted to custom applications built directly on the affected library.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
