Executive brief
Ash is a data-layer abstraction framework used to build data-driven applications. A missing authorization check in the atomic update operation allows attackers to modify database records that should be protected by access control policies, potentially enabling unauthorized changes to data belonging to other users or tenants.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the Ash.update_many/4 function. When the atomic strategy is enabled and supported by the data layer (e.g., SQL MERGE), the function bypassed resource policy filters even when authorize?: true was set, executing updates directly at the data layer without policy enforcement. An attacker with network access to an application using vulnerable Ash versions could craft update requests to modify any records matched by primary key, circumventing row-level security policies. The fix restricts atomic updates to data layers supporting changeset filters during authorization, validates each changeset against policies, and applies the policy filter to the atomic statement. Affected versions: 3.29.0 through 3.32.1; patched in 3.32.2.
Affected products
- ash-project ash 3.29.0 before 3.32.2
Timeline
- 2026-09-01: disclosed: CVE-2026-82746 published