CVE-2026-93477
Received Received - Intake

Improper Object Attribute Control in Ash Framework

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: EEF

Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered. Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation. The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option. This issue affects ash: from 2.17.15 before 3.33.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-93477
EUVD
EUVD-2026-86550

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 2.17.15 (inc) to 3.33.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Ash framework allows users to set private action arguments during bulk destroy or bulk update operations. Private arguments are meant to be controlled only by server-side code but were incorrectly modifiable via user input. This occurs because the bulk operations match all user-provided keys against action arguments without checking the public? flag.

Impact Analysis

This vulnerability can lead to integrity violations or privilege escalation. Attackers could override server-controlled data like audit metadata, authorization fields, or record ownership by setting private arguments to arbitrary values. This requires an authenticated user with permission to trigger bulk operations.

Mitigation Strategies
  • Upgrade the ash framework to version 3.33.11 or later to address the vulnerability in bulk destroy and bulk update operations.
  • Review all bulk destroy and bulk update actions in your application to ensure private arguments are not exposed to user input.
  • Apply the public? check enforcement in argument matching for bulk operations as described in the fix commits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart