CVE-2026-82746: Ash Package Authorization Bypass in Update Operations
Summary
CVE-2026-82746: Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update\_many/4. Affects ash across 2 version ranges.
>= 3.29.0, < 3.32.2
>= 45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335, < ed4e656822ffe83f8e960d5de0b573c0d1ae7f29
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash framework is an open-source Elixir library designed for building APIs and managing data. It provides a robust set of tools for defining resources, actions, and policies, enabling developers to create complex applications with ease. However, a recent vulnerability has been identified that allows unauthorized updates to records, undermining the framework's security model.
Vulnerability Detail
The vulnerability arises from a missing authorization check in the Ash.update_many/4 atomic path, which allows actors to update records that should be restricted by resource policies. Specifically, when using the atomic strategy, the update operation bypasses the necessary authorization checks, enabling unauthorized users to modify records belonging to other actors or tenants. This flaw poses significant risks, including data integrity issues and unauthorized access to sensitive information.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional checks in their application logic to ensure that only authorized users can perform update operations. This may involve manually verifying user permissions before executing any update actions.
Conclusion
CVE-2026-82746 presents a significant security risk for applications using the Ash framework, allowing unauthorized updates to records. It is crucial for developers to update to the patched version 3.32.2 or later to mitigate this vulnerability and ensure the integrity of their applications.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82746 is a vulnerability in the Ash framework that allows unauthorized updates to records due to missing authorization checks in the update operation.
If your application uses the Ash framework and is affected by this vulnerability, unauthorized users may gain the ability to modify sensitive records, leading to potential data breaches.
The vulnerability affects Ash versions from 3.29.0 up to, but not including, 3.32.2.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement additional authorization checks in your application to prevent unauthorized updates until you can upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
