CVE-2024-49756: AshPostgres Policy Bypass in Empty Update Actions
Summary
CVE-2024-49756: In AshPostgres, empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. Affects ash_postgres versions >= 2.0.0, < 2.4.10. Fixed in 2.4.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPostgres is an open-source package designed for managing PostgreSQL databases within the Ash framework. It facilitates seamless integration and interaction with PostgreSQL, allowing developers to define resources, actions, and policies for data manipulation. However, it has been identified that under specific conditions, the package is vulnerable to a policy bypass when executing empty update actions, which could lead to unintended side effects.
Vulnerability Detail
The vulnerability arises from the ability of certain empty update actions to bypass defined policies, allowing side effects to be triggered without proper authorization. This occurs in scenarios where an update action does not change any fields and is performed atomically. The conditions for this vulnerability include the absence of attributes with 'update default', the action being atomic, and the presence of at least one authorizer. The implications are significant as it could lead to unauthorized actions being executed, although it does not allow unauthorized data access.
How To Fix
Latest published version: 2.15.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider the following workarounds: 1. Verify that none of your actions are vulnerable using the provided script. 2. Add require_atomic? false to any potentially affected update action. 3. Replace any usage of Ash.update with Ash.bulk_update for affected actions. 4. Add an update timestamp to your action to prevent the execution of empty updates.
Conclusion
The CVE-2024-49756 vulnerability in AshPostgres poses a moderate risk by allowing policy bypass in empty update actions. It is crucial for users of the package to update to version 2.4.10 or implement the suggested workarounds to safeguard their applications from potential unauthorized actions.
See every vulnerability recorded for ash_postgres →
FAQ
CVE-2024-49756 is a vulnerability in the AshPostgres package that allows policy bypass in empty update actions, potentially leading to unauthorized side effects.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is that unauthorized side effects can be triggered, which could lead to unintended changes or actions being performed in your application.
Yes, the vulnerability has been patched in version 2.4.10 of the AshPostgres package. It is recommended to update to this version.
If you cannot update immediately, consider implementing the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for ash_postgres.
