Missing Authorization Vulnerability in Ash Project by Ash

CVE-2026-82746

What is CVE-2026-82746?

A missing authorization vulnerability in Ash Project's Ash product enables unauthorized actors to update records that are typically restricted by resource policies. The flaw arises from the Ash.update_many/4 function, which executes an atomic update without properly enforcing the resource policies. As a result, an actor can manipulate records across various rows, including those owned by others. The vulnerability has been addressed by updating the atomic strategy to ensure that only authorized changes are executed, thereby reinforcing data integrity and compliance with established policies.

References