CVE-2026-82745
Received Received - Intake

Improper Access Control in Ash Framework

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources. This issue affects ash: from 0.4.0 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82745
EUVD
EUVD-2026-68950

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 0.4.0 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Access Control issue in the ash-project ash framework. It affects versions from 0.4.0 up to 3.32.1. The problem occurs in the ETS and Mnesia data layers where a create action can overwrite an existing record instead of enforcing primary-key uniqueness. Unlike SQL data layers that reject duplicate primary keys, ETS and Mnesia replace any existing entry with the same primary key, allowing silent data destruction or replacement without proper validation.

Detection Guidance

To detect this vulnerability, check if your Ash framework version is between 0.4.0 and 3.32.1. Run: mix deps | grep ash. If the version is in this range, the system is vulnerable. Inspect ETS and Mnesia data layers for unexpected record overwrites by monitoring logs for primary key conflicts or duplicate insert errors.

Impact Analysis

This vulnerability allows an attacker to overwrite existing records by providing a duplicate primary key, potentially destroying or replacing another entity's data without going through update actions or policies. This could lead to unauthorized data modification, loss of data integrity, and potential exposure of sensitive information if the overwritten data belongs to another user.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data modification or destruction. GDPR requires data integrity and protection, while HIPAA mandates safeguards against unauthorized access or alteration. The flaw allows silent overwriting of records, potentially violating these requirements and leading to non-compliance.

Mitigation Strategies

Upgrade Ash framework to version 3.32.2 or later immediately. Update dependencies using: mix deps.update ash. Verify the fix by testing create actions with duplicate primary keys to ensure they are rejected. Review data integrity in ETS and Mnesia layers after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart