An authorization bypass vulnerability in the ash_typescript library allows unauthorized users to access restricted data, posing a high risk to sensitive application information.

The vulnerability exists in the result processing logic of the ash_typescript library, specifically within the normalize_primitive function. Due to improper handling of forbidden field markers, serialized data can leak restricted attribute values to unauthorized callers.

This vulnerability allows an unauthorized attacker to extract sensitive information that the application was intended to protect via field policies. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to significant data exposure, privacy violations, and non-compliance with data protection regulations.

Immediate Action: Update the ash_typescript library to version 0.18.0 or later to ensure the proper sanitization of forbidden field markers.

Proactive Monitoring: Review application logs for unusual RPC request patterns or unexpected data retrieval attempts from embedded resources that may indicate attempted exploitation of this flaw.

Compensating Controls: If an immediate update is not feasible, restrict access to public-facing RPC endpoints that utilize the vulnerable normalize_value_for_json function until the patch can be applied.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to data confidentiality by circumventing established field-level security policies. Administrators should prioritize updating the ash_typescript dependency to the remediated version, as the flaw is straightforward to trigger via public entry points. Failure to patch may result in the unauthorized disclosure of restricted resource attributes.