High severity · published Sep 7, 2025
CVE-2025-48042
Before action hooks may execute in certain scenarios despite a request being forbidden
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects ash: from 0.1.1 before 3.5.39.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ash · ash-project
0.1.1 before 3.5.39; 4c41344126b0aba09ec3085517000f8aefec299e before 5d1b6a5d00771fd468a509778637527b5218be9a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48042
cna.erlef.org
https://cna.erlef.org/cves/CVE-2025-48042.html
github.com
https://github.com/ash-project/ash/commit/4c41344126b0aba09ec3085517000f8aefec299e
github.com
https://github.com/ash-project/ash/commit/5d1b6a5d00771fd468a509778637527b5218be9a
github.com
https://github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9
osv.dev
https://osv.dev/vulnerability/EEF-CVE-2025-48042
More from ash
8.6
CVE-2025-48044
Authorization bypass when bypass policy condition evaluates to true
8.6
CVE-2025-48043
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
8.2
CVE-2026-94201
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
7.6
CVE-2026-96581
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
7.5
CVE-2026-34593
Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash