Executive brief
Ash is a framework for building applications in the Elixir programming language. A security flaw in how it handles bulk data operations (like creating or updating many records at once) could allow a user to trigger certain background tasks even if they do not have permission to perform the overall action. While the unauthorized action itself will still fail and block data access, the background tasks could perform expensive operations or cause unintended side effects before the system stops the request.
Technical details
An incorrect authorization vulnerability exists in the Ash framework's bulk action logic (create, update, and destroy). When a bulk action is invoked that contains a 'before_transaction' hook but lacks an 'after_transaction' hook, the framework executes the hook before performing authorization checks. An authenticated attacker with network access can trigger these hooks despite receiving a 'Forbidden' error for the overall request. This can lead to the execution of side-effectful or resource-intensive operations defined within the hooks. The issue is rooted in the execution order within 'lib/ash/actions/create/bulk.ex', 'lib/ash/actions/destroy/bulk.ex', and 'lib/ash/actions/update/bulk.ex'. The vulnerability is addressed in version 3.5.39.
Affected products
- ash-project ash 0.1.0 to 3.5.38
Timeline
- 2025-09-06: advisory: GitHub Security Advisory GHSA-jj4j-x5ww-cwh9 published
- 2025-09-07: disclosed: CVE-2025-48042 published
- 2025-09-07: patched: Fixed in version 3.5.39