Ash-Project Ash 3.0.0-rc.17/3.32.1 Reactor change_step.ex Ash.Reactor.ChangeStep.apply_where_clauses access control

Summaryinfo

A vulnerability classified as critical was found in Ash-Project Ash 3.0.0-rc.17/3.32.1. Affected by this issue is the function Ash.Reactor.ChangeStep.apply_where_clauses of the file lib/ash/reactor/steps/change_step.ex of the component Reactor. The manipulation results in access control. This vulnerability is known as CVE-2026-82744. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in Ash-Project Ash 3.0.0-rc.17/3.32.1. Affected is the function Ash.Reactor.ChangeStep.apply_where_clauses of the file lib/ash/reactor/steps/change_step.ex of the component Reactor. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed. This issue affects ash: from 3.0.0-rc.17 before 3.32.2.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-82744 since 08/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 3.32.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• Ash-Project

Name

• Ash

Version

• 3.0.0-rc.17
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion