CVE-2026-82746
Received Received - Intake

Missing Authorization in Ash Framework via Ash.update_many

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows. This issue affects ash: from 3.29.0 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82746
EUVD
EUVD-2026-68951

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 3.29.0 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Missing Authorization vulnerability in the Ash framework's Ash.update_many/4 function. It allows an attacker to update records that should be forbidden by resource policies when using atomic operations. Normally, policies restrict which records can be modified, but the atomic path bypassed these checks, enabling unauthorized updates to sensitive data like records belonging to other users or tenants.

Detection Guidance

To detect this vulnerability, check if your Ash framework version is between 3.29.0 and 3.32.1. Run: mix deps | grep ash. If the version falls in this range, the system is vulnerable. Review application logs for unauthorized update_many operations, especially those using atomic strategies.

Impact Analysis

If you use the Ash framework versions 3.29.0 to 3.32.1, an attacker could exploit this to modify data they should not access. This could lead to data corruption, unauthorized changes to user accounts, or exposure of sensitive information. The impact depends on the application's data but could include loss of data integrity or confidentiality.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized modifications to personal or health data. GDPR requires strict access controls and data integrity, while HIPAA mandates protection against unauthorized changes to protected health information. Exploiting this flaw could lead to unauthorized data alterations, breaching these regulations.

Mitigation Strategies

Upgrade the Ash framework to version 3.32.2 or later immediately. Update your dependencies using mix deps.update ash. After updating, verify the fix by testing policy enforcement on update_many operations with atomic strategies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart