EEF-CVE-2026-114214

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

## Summary Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship. When a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination's policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship. This issue affects ash: from 3.24.0 before 3.37.1. ## Impact A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship. ## Configurations Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource's read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller.