Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-48044
PUBLISHED
More InfoOfficial Page
Assigner-EEF
Assigner Org ID-6b3ad84c-e1a6-4bf7-a703-f496b71e49db
View Known Exploited Vulnerability (KEV) details
Published At-17 Oct, 2025 | 13:52
Updated At-24 Jul, 2026 | 14:13
Rejected At-
▼CVE Numbering Authority (CNA)
Authorization bypass when bypass policy condition evaluates to true

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2. This issue affects ash: from 3.6.3 before 3.7.1.

Affected Products
Vendor
ash-project
Product
ash
Collection URL
https://repo.hex.pm
Package Name
ash
Repo
https://github.com/ash-project/ash
CPEs
  • cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Program Files
  • lib/ash/policy/policy.ex
Program Routines
  • 'Elixir.Ash.Policy.Policy':expression/2
Default Status
unaffected
Versions
Affected
  • From 3.6.3 before 3.7.1 (semver)
Vendor
ash-project
Product
ash
Collection URL
https://github.com
Package Name
ash-project/ash
Repo
https://github.com/ash-project/ash
CPEs
  • cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Program Files
  • lib/ash/policy/policy.ex
Program Routines
  • 'Elixir.Ash.Policy.Policy':expression/2
Default Status
unaffected
Versions
Affected
  • From 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d (git)
Problem Types
TypeCWE IDDescription
CWECWE-863CWE-863 Incorrect Authorization
Type: CWE
CWE ID: CWE-863
Description: CWE-863 Incorrect Authorization
Metrics
VersionBase scoreBase severityVector
4.08.6HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-115CAPEC-115 Authentication Bypass
CAPEC ID: CAPEC-115
Description: CAPEC-115 Authentication Bypass
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Jechol Lee
remediation developer
Jechol Lee
analyst
Jonatan Männchen / EEF
remediation reviewer
Zach Daniel
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752
vendor-advisory
related
https://cna.erlef.org/cves/CVE-2025-48044.html
related
https://osv.dev/vulnerability/EEF-CVE-2025-48044
related
https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d
patch
Hyperlink: https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752
Resource:
vendor-advisory
related
Hyperlink: https://cna.erlef.org/cves/CVE-2025-48044.html
Resource:
related
Hyperlink: https://osv.dev/vulnerability/EEF-CVE-2025-48044
Resource:
related
Hyperlink: https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d
Resource:
patch
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752
exploit
Hyperlink: https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752
Resource:
exploit
Details not found