A critical authorization bypass vulnerability in ash_graphql allows authenticated subscribers to access unauthorized cross-tenant data, posing a significant risk to multi-tenant data privacy.

The vulnerability exists in the subscription resolver, which performs authorization checks in-memory without applying necessary tenant-level guards. Because the evaluation logic fails to enforce tenant isolation during the subscription process, an authenticated user can receive data records belonging to a different tenant.

Successful exploitation of this vulnerability results in unauthorized access to sensitive data across tenant boundaries, which directly violates data privacy and compliance requirements. With a CVSS score of 7.1, this high-severity flaw could lead to significant data exposure and loss of customer trust in multi-tenant environments.

Immediate Action: Upgrade the ash_graphql package to version 1.11.0 or later to ensure that proper tenant guards are applied to all subscription resolvers.

Proactive Monitoring: Review application logs for unusual GraphQL subscription traffic or patterns where users are accessing data that appears outside their assigned tenant scope.

Compensating Controls: If immediate patching is not feasible, restrict access to the GraphQL subscription endpoints or implement secondary application-level filtering to validate tenant ownership before data is transmitted to the client.

Public Exploit Available: No

The severity of this authorization flaw necessitates immediate attention, particularly for providers of multi-tenant software services. Organizations using ash_graphql must prioritize upgrading to the fixed version to prevent potential data leakage between tenants, as the current implementation fails to enforce mandatory access control boundaries.