Improper Control of Object Attributes in Ash Project by Ash Vendor

CVE-2026-93477

What is CVE-2026-93477?

The vulnerability arises from the inadequate handling of private action arguments in bulk destroy and bulk update operations of the Ash Project. Attackers can exploit this flaw to manipulate private arguments that should only be set by trusted server-side code. This could potentially lead to serious security issues, including integrity violations and privilege escalations, as unauthorized users might gain control over critical application components. The recommended fix necessitates strict checks on public attributes in matching parameters, ensuring that private arguments remain secure and can only be modified server-side.

References