Executive brief
Ash is a framework for building data layers in Elixir applications. A vulnerability in its Reactor change step logic allows security-relevant modifications to be skipped when guard conditions raise exceptions due to malformed or attacker-influenced input. Instead of failing safely, the system silently bypasses the intended change, potentially allowing unauthorized operations to proceed without enforcement.
Technical details
The vulnerability is a logic error in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) where the apply_where_clauses/3 function rescues exceptions from guard evaluations and treats them identically to unmet guard conditions. When a guard raises an exception (e.g., on attacker-supplied input), the change is bypassed rather than failing the step. The fix distinguishes between a raised exception (returned as {:raised, error}) and a simple false condition, now halting the step with an error (failing closed). The vulnerability affects versions 3.0.0-rc.17 through 3.32.1; patched in 3.32.2.
Affected products
- ash-project ash 3.0.0-rc.17 to before 3.32.2
Timeline
- 2026-09-01: disclosed: CVE-2026-82744 published
- 2026: patched: Fixed in ash 3.32.2