Ash Framework CVE-2026-82746

Exploitation requires all of the following conditions simultaneously: (1) ash versions 3.29.0 to 3.32.1 are in use; (2) the application calls Ash.update_many/4 with authorize?: true; (3) the selected update strategy is :atomic or :atomic_batches; (4) the data layer supports atomic bulk updates (e.g., AshPostgres on PostgreSQL with MERGE support, confirmed by the data layer reporting :changeset_filter capability); and (5) the actor has sufficient application access to invoke the update_many operation. Applications using non-atomic strategies, those without calls to update_many, or those on data layers without atomic bulk-update support are not affected. The primary limiting factor is the intersection of data-layer capability and update strategy configuration, which is not universal across Ash deployments.

The CVSS 4.0 base score of 5.9 with AV:L/AC:L/AT:P/PR:N reflects medium severity, but AT:P is the critical limiting signal: exploitation requires the application to call Ash.update_many/4 with atomic strategy on a data layer that supports atomic bulk updates - a configuration not present in all Ash deployments. The high integrity impact (VI:H) is meaningful for multi-tenant applications that rely on Ash resource policies for tenant isolation rather than database-level row security, where a successful bypass could enable cross-tenant writes. No EPSS score was supplied in the input, and this CVE is not listed in the CISA KEV catalog, so exploitation probability cannot be quantified from available data. The supplied CVSS 4.0 vector assigns PR:N (no privileges required), which may overstate exposure for deployments where application-layer authentication is required before any actor can invoke update_many; defenders should verify whether their application exposes this code path to unauthenticated callers, as the realistic attack surface depends heavily on application design. The public patch diff is detailed enough to reconstruct the bypass path without specialist effort, which elevates urgency for affected configurations relative to what the numeric score alone implies.

A tenant actor in a multi-tenant Ash application calls Ash.update_many/4 targeting records by primary key, including IDs belonging to a different tenant. Because the atomic update path bypasses the resource policy filter, the underlying SQL MERGE updates all matched rows regardless of tenant policy restrictions, writing attacker-controlled values into records the actor does not own. No dedicated exploit code has been identified, but the public patch diff makes the bypass path straightforward to understand.