Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82746— Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Quick assessment

Affected
ash-project ash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： ash 项目中存在缺失授权（Missing Authorization）漏洞 该漏洞存在于 ash 框架中，允许调用者通过 的原子执行路径，更新那些被资源策略（resource policies）禁止操作的记录。 当使用了原子策略且数据层支持时， 会作为单个原子语句执行（例如数据层的 ，如 SQL 的 语句）。然而， （位于 ）在设置 的情况下依然选择了原子路径，却未应用资源的策略，导致该语句会根据主键匹配到所有行并进行更新，完全忽略了授权本应施加的策略过滤器。因此，调用者可以更新

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82746

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows. This issue affects ash: from 3.29.0 before 3.32.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash 3.29.0 ~ 3.32.2 cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
ash-project ash 45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335 ~ ed4e656822ffe83f8e960d5de0b573c0d1ae7f29 cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82746

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82746

请登录查看更多情报信息。

Other References for CVE-2026-82746 (4)

Same Patch Batch · ash-project · 2026-09-01 · 23 CVEs total

CVE-2026-74837 8.7 HIGH Unbounded atom creation from client-supplied RPC field names in AshTypescript field format
CVE-2026-77856 8.2 HIGH Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-82730 8.2 HIGH Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-77950 6.3 MEDIUM RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-82732 6.3 MEDIUM Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82733 6.3 MEDIUM Route handler return value echoed into AshTypescript error response
CVE-2026-82737 5.9 MEDIUM Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting
CVE-2026-82735 5.9 MEDIUM Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82747 5.9 MEDIUM Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82738 5.9 MEDIUM Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of
CVE-2026-82742 5.9 MEDIUM Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships,
CVE-2026-82745 5.9 MEDIUM ETS and Mnesia data layers overwrite an existing record on create instead of enforcing pri
CVE-2026-82749 5.9 MEDIUM Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is
CVE-2026-82731 2.3 LOW Unescaped path parameters in AshTypescript generated TypeScript client allow request redir
CVE-2026-82739 2.1 LOW Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic misma
CVE-2026-82740 2.1 LOW Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82736 2.1 LOW Ash.Type.CiString validates length and match constraints before case folding, allowing con
CVE-2026-82741 2.1 LOW Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82734 2.1 LOW Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82743 2.1 LOW Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ash
Same vendor: ash-project
Same weakness: CWE-862

V. Comments for CVE-2026-82746

No comments yet

Leave a comment