CVE-2025-48043CWE-863broken-access-control

CVE-2025-48043

published October 10, 2025

CVSS

8.6

EPSS

0%

Percentile

31.4

In the wild

Unconfirmed

What it is

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass.

This issue affects ash: from 0.1.1 before 3.6.2.

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00386 · 31.4th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-10-10T20:15Z

References (5)

https://cna.erlef.org/cves/CVE-2025-48043.html · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/commit/4c41344126b0aba09ec3085517000f8aefec299e · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://osv.dev/vulnerability/EEF-CVE-2025-48043 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

EPSS history

Timeline

10 OCT 15:57Z
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
cvelistv5