Executive brief
Ash is an Elixir framework for building data-driven applications. When using ETS or Mnesia as the data layer, a user who can specify a primary key during record creation can silently overwrite existing records without authorization, destroying another entity's data instead of creating a new record.
Technical details
The vulnerability is an improper access control flaw in Ash's ETS and Mnesia data layers. Unlike SQL databases which enforce primary-key uniqueness constraints and reject duplicate keys on insert, the ETS and Mnesia implementations use a keyed insert operation that silently replaces any existing record with the same primary key. An attacker who can control the primary key value submitted during a create action can craft a request with a key matching an existing record, causing that record to be overwritten without invoking update policies or access controls. The fix, available in version 3.32.2 and later, rejects creates with duplicate primary keys using an "already-taken" error and only permits duplicates for keyless resources.
Affected products
- ash-project ash 0.4.0 before 3.32.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in version 3.32.2