Improper Access Control in Ash Project's Data Layer - Ash

CVE-2026-82745

What is CVE-2026-82745?

The Ash Project suffers from an improper access control issue within its ETS and Mnesia data layers. This flaw permits a create action to overwrite existing records due to the lack of enforced primary-key uniqueness during inserts. Unlike SQL data layers, which reject duplicates based on unique key constraints, the ETS and Mnesia layers allow the replacement of entries with the same primary key. An attacker capable of specifying the primary key—potentially from user input—can exploit this weakness to silently overwrite data, resulting in the loss of existing records without triggering any update mechanisms or associated policies. The vulnerability is mitigated in later versions by enforcing primary key checks, rejecting creations that attempt to duplicate existing keys.

References