CVE-2026-82564
Received Received - Intake

Authorization Bypass in Ash.AI Tool Execution

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs. This issue affects ash_ai: from 0.6.0 before 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82564
EUVD
EUVD-2026-68306

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_ai From 0.6.0 (inc) to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key in the ash_ai library. It allows attackers to bypass identity checks by sending crafted JSON arguments that manipulate how records are filtered during update or delete operations. The flaw occurs because the identity_filter function builds filters directly from raw tool arguments without proper validation, enabling attackers to retarget operations at unintended records.

Detection Guidance

Check for unauthorized bulk updates or deletions in your Ash_ai logs, particularly for operations using nested JSON operands like {"public_ref": {"not_eq": "<own-ref>"}}. Review tool execution logs for identity_filter/3 calls with raw arguments that bypass identity checks.

Impact Analysis

An attacker could exploit this to modify or delete records they do not own, including bulk operations affecting entire tables. This could lead to data loss, unauthorized changes to sensitive information, or manipulation of application behavior. The impact depends on the application's use of ash_ai but may include compromised user data or system integrity.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR requires protecting personal data integrity and access controls, while HIPAA mandates strict access controls for protected health information. Exploitation could lead to breaches, unauthorized disclosures, or data tampering, resulting in legal penalties or loss of certification.

Mitigation Strategies

Upgrade ash_ai to version 1.0.0 or later to apply the patch. If upgrading is not possible, restrict access to AshAi.Tool.Execution and disable bulk operations like Ash.bulk_update! and Ash.bulk_destroy! until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart