EUVD-2026-38570Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Parameters arrive over the network in typical Ash web deployments (AV:N); no privileges required to submit input; integrity impact is high when private arguments gate authorization decisions.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument that is intended to be controlled only by trusted server-side code.
Action arguments declared with public?: false are meant to be set internally (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. When a changeset is built from a parameter map, Ash filters out private arguments, but the filtering is incomplete.
In the regular changeset path (for_create, for_update, for_destroy), private arguments are stripped only when the parameter key is an atom. When the key is a binary (string), as is the case for user-supplied parameters, the private argument is kept and the user controls its value. In the atomic path (Ash.Changeset.fully_atomic_changeset/4, also reached through atomic and bulk updates), private arguments are not stripped at all, regardless of whether the key is an atom or a binary.
An attacker who can submit parameters to an action that defines a private argument can therefore inject a value for that argument. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership), this can lead to an integrity violation or privilege escalation.
This issue affects ash: from 3.0.0 before 3.29.3.
AnalysisAI
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action arguments explicitly marked public?: false, which are designed to be controlled exclusively by trusted server-side code. The filtering logic in both the regular changeset path and the atomic changeset path fails to enforce the public? flag when input parameters arrive as string (binary) keys - the default format for user-supplied JSON or form data. An attacker who submits a string-keyed parameter matching a private argument name can inject an arbitrary value, potentially enabling privilege escalation or integrity violations if that argument drives authorization decisions such as acting_user_id or record ownership. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Ash is an Elixir framework for building resource-driven APIs using a declarative data layer. Actions in Ash accept arguments; the public?: false flag on an argument (CWE-915) is supposed to make it invisible to external callers, settable only via Ash.Changeset.set_private_argument/3 from server-side code. The root cause is an incomplete guard in lib/ash/changeset/changeset.ex: the Enum.find/Enum.any? predicates that look up arguments by name were missing the &1.public? check when matching on binary (string) keys. Because user-supplied parameters from JSON or form submissions naturally arrive as string keys, the atom-keyed path appeared safe while the string-keyed path silently accepted private arguments. The atomic changeset path (Ash.Changeset.fully_atomic_changeset/4, reached through atomic and bulk updates) had no public? check at all - neither atom nor string keys were filtered. The confirmed fix adds &1.public? && guards to all three predicates (commit d9b3100219b3ea86d73202bf7368c03a7688efea), ensuring private arguments are rejected as Ash.Error.Invalid.NoSuchInput in all code paths. Affected CPE: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade ash to version 3.29.3 or later, which contains the authoritative fix from commit d9b3100219b3ea86d73202bf7368c03a7688efea that adds &1.public? guards to all argument lookup predicates in lib/ash/changeset/changeset.ex. The vendor advisory is at https://github.com/ash-project/ash/security/advisories/GHSA-f4hc-ppw9-4hhw and the OSV record is at https://osv.dev/vulnerability/EEF-CVE-2026-55736. If immediate patching is not feasible, audit every action that defines private arguments (public?: false) and assess whether those arguments influence security-sensitive behavior such as authorization, ownership assignment, or tenant resolution. As a compensating control, add explicit server-side assertions in action code to verify that security-critical private arguments equal the server-computed value before proceeding - this adds overhead and is not a substitute for patching. Disabling atomic and bulk update paths for actions with sensitive private arguments eliminates the fully unguarded code path but may break intended application functionality.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor wh
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications th
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elix
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create ac
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to a
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship sc
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify rec
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today