Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Authorization CWE-285 CWE-285 at MITRE
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Incorrect Authorization CWE-863
29
(87.9%)
Missing Authorization CWE-862
4
(12.1%)
Missing User Interaction for Potentially Unsafe Action CWE-356
0
(0.0%)
Files or Directories Accessible to External Parties CWE-552
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Improper Export of Android Application Components CWE-926
0
(0.0%)
Use of Implicit Intent for Sensitive Communication CWE-927
0
(0.0%)
Exposure of Sensitive Information Through Metadata CWE-1230
0
(0.0%)
Improper Restriction of Software Interfaces to Hardware Features CWE-1256
0
(0.0%)
Unprotected Confidential Information on Device is Accessible by OSAT Vendors CWE-1297
0
(0.0%)
Security Version Number Mutable to Older Versions CWE-1328
0
(0.0%)
Improper External Identity Verification CWE-1470
0
(0.0%)
Classified as CWE-285 itself, not a child weakness
1
CVEs
CVEs for Improper Authorization CWE-285
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | CVE-2026-96581 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 | |
| Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records | CVE-2026-114214 | 2026-10-25 | |
| Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts | CVE-2026-101028 | 2026-10-09 | |
| Confirmation token accepted on any record in AshAuthentication | CVE-2026-82685 | 2026-09-17 | |
| AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | CVE-2026-82586 | 2026-09-07 | |
| ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | CVE-2026-82754 | 2026-09-07 | |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor | CVE-2026-82747 | 2026-09-01 | |
| Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records | CVE-2026-82749 | 2026-09-01 | |
| Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another | CVE-2026-82748 | 2026-09-01 | |
| Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records | CVE-2026-82746 | 2026-09-01 | |
| Authorization-redacted field values disclosed through AshTypescript result normalization | CVE-2026-82730 | 2026-09-01 | |
| AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data | CVE-2026-82725 | 2026-08-31 | |
| Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain | CVE-2026-82724 | 2026-08-31 | |
| AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle | CVE-2026-81853 | 2026-08-31 | |
| Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records | CVE-2026-82564 | 2026-08-31 | |
| Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read | CVE-2026-80223 | 2026-08-30 | |
| Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification | CVE-2026-81643 | 2026-08-30 | |
| exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql | CVE-2026-77454 | 2026-08-30 | |
| Same-named aggregates with differing filters are conflated in AshSql | CVE-2026-81316 | 2026-08-30 | |
| Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql | CVE-2026-81318 | 2026-08-30 | |
| OAuth token exchange grants repository scopes for organizations the principal cannot access | CVE-2026-75542 | 2026-08-24 | |
| Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding | CVE-2026-48599 | 2026-06-15 |
25 per page ·
34 CVEs