ash-project ash up to 3.32.1 UpdateMany update_many.ex Ash.update_many improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in ash-project ash up to 3.32.1. This affects the function Ash.update_many of the file lib/ash/actions/update/update_many.ex of the component UpdateMany. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-82746. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in ash-project ash up to 3.32.1. Affected by this vulnerability is the function Ash.update_many of the file lib/ash/actions/update/update_many.ex of the component UpdateMany. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity. The summary by CVE is:

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows. This issue affects ash: from 3.29.0 before 3.32.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-82746 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 3.32.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash

Version

• 3.32.0
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion