High severity · published Oct 17, 2025
CVE-2025-48044
Authorization bypass when bypass policy condition evaluates to true
8.6
CVSS
0.7%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass.
This issue affects ash: from 3.6.3 before 3.7.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ash · ash-project
3.6.3 before 3.7.1; 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48044
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48044
cna.erlef.org
https://cna.erlef.org/cves/CVE-2025-48044.html
github.com
https://github.com/ash-project/ash/commit/79749c2685ea031ebb2de8cf60cc5edced6a8dd0
github.com
https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d
github.com
https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752
osv.dev
https://osv.dev/vulnerability/EEF-CVE-2025-48044
More from ash
8.6
CVE-2025-48043
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
8.2
CVE-2026-94201
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
7.6
CVE-2026-96581
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
7.5
CVE-2026-34593
Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash
7.4
CVE-2026-67579
Filter expression injection via forged keyset pagination cursor in Ash