GHSA-pcxq-fjp3-r752 Ash has authorization bypass when bypass policy condition evaluates to true

• Hex ash: >= 3.6.3, < 3.7.1 → fixed in 3.7.1

Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply. Impact Resources with bypass policies can be accessed without proper authorization when: • Bypass condition evaluates to true • Bypass authorization checks fail • Other policies exist but their conditions don't match Details Vulnerable code in: lib/ash/policy/policy.ex:69 ```elixir {%{bypass?: true}, cond_expr, complete_expr}, {one_condition_matches, all_policies_match} -> { b(cond_expr or one_condition_matches), # { b(complete_expr or one_condition_matches), # { b(complete_expr or one_condition_matches), # <- For consistency complete_expr } ``` PoC ```elixir policies do bypass always() do authorize_if actor_attribute_equals(:is_admin, true) end policy action_type(:read) do authorize_if always() end end ``` Non-admin user can perform create actions (should be denied). Test demonstrating the bug: ```elixir test "bypass policy bug" do policies = [ %Ash.Policy.Policy{ bypass?: true, condition: [{Ash.Policy.Check.Static, result: true}], # condition = true policies: [ %Ash.Policy.Check{ type: :authorize_if, check: {Ash.Policy.Check.Static, result: false}, # policies = false check_module: Ash.Policy.Check.Static, check_opts: [result: false] } ] }, %Ash.Policy.Policy{ bypass?: false, condition: [{Ash.Policy.Check.Static, result: false}], policies: [ %Ash.Policy.Check{ type: :authorize_if, check: {Ash.Policy.Check.Static, result: true}, check_module: Ash.Policy.Check.Static, check_opts: [result: true] } ] } ] expression = Ash.Policy.Policy.expression(policies, %{}) assert expression == false # Expected: false (deny) # Actual on main: true (incorrectly authorized) end ```