Answer in brief
CVE-2026-78216 records a Medium severity (CVSS 6.0) vulnerability in AshLua eval read operations can read field-policy-protected fields via aggregates. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_lua (generic), ash-project/ash_lua (generic), ash-project/ash-project/ash_lua (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_lua (generic), ash-project/ash_lua (generic), ash-project/ash-project/ash_lua (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_luageneric | >=8675e47cca81f36594083a7e63379bac9e123e72 <266a5dcc56d5015b6d316c10606169e753b07450 | 266a5dcc56d5015b6d316c10606169e753b07450 |
| ash-project/ash_luageneric | >=0.1.0 <0.2.2 | 0.2.2 |
| ash-project/ash-project/ash_luageneric | >=8675e47cca81f36594083a7e63379bac9e123e72 <266a5dcc56d5015b6d316c10606169e753b07450 | 266a5dcc56d5015b6d316c10606169e753b07450 |
Published upstream
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 8, 2026
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_lua: from 0.1.0 before 0.2.2.
Quoted source text, attributed separately from HOL analysis.