ash-project ash_ai up to 0.9.x Identity Filter AshAi.Tool.Execution.identity_filter key authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in ash-project ash_ai up to 0.9.x. Affected is the function AshAi.Tool.Execution.identity_filter of the component Identity Filter. Performing a manipulation of the argument key results in authorization. This vulnerability is cataloged as CVE-2026-82564. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in ash-project ash_ai up to 0.9.x. This affects the function AshAi.Tool.Execution.identity_filter of the component Identity Filter. The manipulation of the argument key with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs. This issue affects ash_ai: from 0.6.0 before 1.0.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-82564 since 08/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.0.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_ai

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9

Website

• Product: https://github.com/ash-project/ash_ai/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion