Authorization Bypass Vulnerability in Ash Project's Ash AI

CVE-2026-82564

What is CVE-2026-82564?

The vulnerability in Ash Project's Ash AI allows unauthorized users to perform update or destroy operations on database records. This occurs due to the faulty construction of update/destroy filters directly from user-provided arguments, making it possible for attackers to manipulate the records without proper identification. An attacker could exploit this by sending crafted requests that omit necessary identity keys, resulting in arbitrary records being targeted. The issue has been addressed in versions following 1.0.0, which enforce stricter validation on identity values to mitigate this risk.

References