CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Attackers can bypass resource policies to modify forbidden records in Ash applications using the atomic update_many function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82746?
CVE-2026-82746 is a medium-severity missing authorization vulnerability in ash-project ash, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.
Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.
This issue affects ash: from 3.29.0 before 3.32.2.
Weakness: CWE-862
Which versions are affected by CVE-2026-82746?
1 open source package ship an affected version, including ash.
| Package | Affected | Fixed in |
|---|---|---|
ash Hex | From 3.29.0 | 3.32.2 |
How do I fix CVE-2026-82746?
Upgrade ash to 3.32.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-82746 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82746 exists.
Sources
Also known as EEF-CVE-2026-82746, GHSA-j7c9-3fw3-jc64.