Vulnerability Database
296,663
Total vulnerabilities in the database
CVE-2025-48044
Summary
Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply.
Impact
Resources with bypass policies can be accessed without proper authorization when:
- Bypass condition evaluates to true
- Bypass authorization checks fail
- Other policies exist but their conditions don't match
Details
Vulnerable code in: lib/ash/policy/policy.ex:69
{%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} ->
{
b(cond_expr or one_condition_matches), # <- Bug: uses condition only
b(complete_expr or all_policies_match)
}
The final authorization decision is: one_condition_matches AND all_policies_match
When a bypass condition is true but bypass policies fail, and subsequent policies have non-matching conditions:
- one_condition_matches =
cond_expr(bypass condition) = true (bug - should check if bypass actually authorizes) - all_policies_match =
(complete_expr OR NOT cond_expr)for each policy- For non-matching policies:
(false OR NOT false)= true (policies don't apply)
- For non-matching policies:
- Final:
true AND true= true (incorrectly authorized)
The bypass condition alone satisfies "at least one policy applies" even though the bypass fails to authorize.
Fix
Replace cond_expr with complete_expr on line 69:
{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, all_policies_match} ->
{
b(complete_expr or one_condition_matches), # <- Fixed
b(complete_expr or all_policies_match)
}
Line 52 should also be updated for consistency (though it's only triggered when bypass is the last policy, making it coincidentally safe in practice):
{%{bypass?: true}, _cond_expr, complete_expr}, {one_condition_matches, true} ->
{
b(complete_expr or one_condition_matches), # <- For consistency
complete_expr
}
PoC
policies do
bypass always() do
authorize_if actor_attribute_equals(:is_admin, true)
end
policy action_type(:read) do
authorize_if always()
end
end
Non-admin user can perform create actions (should be denied).
Test demonstrating the bug:
test "bypass policy bug" do
policies = [
%Ash.Policy.Policy{
bypass?: true,
condition: [{Ash.Policy.Check.Static, result: true}], # condition = true
policies: [
%Ash.Policy.Check{
type: :authorize_if,
check: {Ash.Policy.Check.Static, result: false}, # policies = false
check_module: Ash.Policy.Check.Static,
check_opts: [result: false]
}
]
},
%Ash.Policy.Policy{
bypass?: false,
condition: [{Ash.Policy.Check.Static, result: false}],
policies: [
%Ash.Policy.Check{
type: :authorize_if,
check: {Ash.Policy.Check.Static, result: true},
check_module: Ash.Policy.Check.Static,
check_opts: [result: true]
}
]
}
]
expression = Ash.Policy.Policy.expression(policies, %{})
assert expression == false
# Expected: false (deny)
# Actual on main: true (incorrectly authorized)
end
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime