CVE-2026-82745: Ash Package Allows Overwriting of Existing Records Due to Improper Primary-Key Handling
Summary
CVE-2026-82745: Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Affects ash across 2 version ranges.
>= 0.4.0, < 3.32.2
>= 6dc699d8a683d542812b34a8c104cc90164add3a, < 912e243196017c2a812c25905c2b1cc3bbb843fc
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs and data layers in Elixir applications. It provides a flexible and powerful way to manage data interactions, allowing developers to define resources, actions, and policies. However, a significant vulnerability has been identified in versions prior to 3.32.2, where the ETS and Mnesia data layers do not enforce primary-key uniqueness on record creation, leading to potential data loss.
Vulnerability Detail
The vulnerability arises from improper access control in the Ash package, specifically in the ETS and Mnesia data layers. When a create action is performed, it can overwrite an existing record if the same primary key is used. Unlike SQL databases, which reject duplicate primary keys, the ETS and Mnesia layers replace existing entries with the same key, allowing malicious actors to unintentionally or intentionally overwrite critical data without proper authorization. This can lead to significant data integrity issues and loss of information.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users do not have the ability to set primary keys directly during record creation. Implement additional validation checks in your application logic to prevent the submission of duplicate primary keys until the package can be updated.
Conclusion
The CVE-2026-82745 vulnerability in the Ash package poses a significant risk by allowing the overwriting of existing records due to improper primary-key handling. It is crucial to update to the latest version to mitigate this risk and ensure data integrity within your applications.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82745 is a vulnerability in the Ash package that allows existing records to be overwritten due to improper handling of primary keys in the ETS and Mnesia data layers.
If your application uses the Ash package with ETS or Mnesia data layers, it may be at risk of data loss, as records can be unintentionally overwritten when a create action is performed with an existing primary key.
The vulnerability affects Ash versions from 0.4.0 up to, but not including, 3.32.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement validation checks to prevent users from creating records with existing primary keys as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
