CVE-2026-80223

CVE-2026-80223 is an incorrect authorization flaw (CWE-863) in the ash_graphql library that lets an authenticated subscriber of one tenant receive records belonging to another tenant over GraphQL subscriptions. The subscription resolver authorizes each notification payload in memory, and its fast path (Ash.can/3 with run_queries?: false) evaluates the read policy filter without any tenant condition because Ash applies multitenancy at query-build time, not inside the policy filter; the single-notification clause has no tenant guard at all, and the batched clause only checks the head of the notification list. As a result, a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter evaluates true, yielding unauthorized cross-tenant data disclosure with high confidentiality impact (CVSS 4.0: 7.1 High, network vector, low privileges). Applications are affected if they run ash_graphql 1.4.0 through before 1.11.0 and expose GraphQL subscriptions on multitenant resources. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS puts 30-day exploitation probability at a low 0.2% (16th percentile).

What to do: Upgrade ash_graphql to 1.11.0 or later, which restores tenant-scoped authorization in the subscription resolver. As an interim mitigation, ensure read policies on subscription-exposed resources include an explicit tenant condition or force a tenant-scoped read during notification authorization, and audit any multitenant resources exposed via GraphQL subscriptions for cross-tenant notification leakage.