Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93477— Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Quick assessment

Affected
ash-project ash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 动态确定对象属性控制不当漏洞存在于 ash-project ash 中，允许用户在批量删除（bulk destroy）和批量更新（bulk update）路径中设置私有操作参数的值。 使用 声明的操作参数本应仅由可信的服务器端代码设置（例如通过 ），并且不能由终端用户输入设置。CVE-2026-55736 修复了非批量更改集路径中从用户提供的参数映射中剥离私有参数的问题，但批量删除和批量更新路径未受到保护。 和 会将调用者提供的参数映射中的每个键与操作的所有参数进行匹配，且未进行

CVSS 5.9 · Medium EPSS 0.20% · P8

Affected Version Matrix 2

VendorProduct Version RangeStatus
ash-project ash 2.17.15< 3.33.11 affected
8c17434803b2e91de522bdfbd0ca918e5d5898df< 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93477

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Source: CVE Program / CVE List V5
Vulnerability Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered. Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation. The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option. This issue affects ash: from 2.17.15 before 3.33.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash 2.17.15 ~ 3.33.11 cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
ash-project ash 8c17434803b2e91de522bdfbd0ca918e5d5898df ~ 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-93477

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93477

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93477 (2)

Vendor Advisories for CVE-2026-93477 (3)

IV. Related Vulnerabilities

Same product: ash
Same vendor: ash-project
Same weakness: CWE-915

V. Comments for CVE-2026-93477

No comments yet

Leave a comment