Ash Framework EUVD-2026-86550

Two concrete conditions must both hold: (1) the application exposes a bulk update or bulk destroy action to user-controlled parameters - for example via AshJsonApi, AshGraphql, or a controller that forwards request params to Ash.bulk_update/4 or Ash.bulk_destroy/4; and (2) that action declares a private argument (public?: false) that is security-relevant - referenced by an arg(...) template in the action's changes or validations for authorization (e.g. acting_user_id), record ownership, or audit metadata. Limiting factors: only ash versions 2.17.15 through 3.33.10 are affected (fixed in 3.33.11); the non-bulk changeset path is already protected by CVE-2026-55736; and if no private argument is used in a security-relevant way, the practical impact is negligible. Server-side code can still legitimately set these via the :private_arguments option after the fix.

This is a real but conditional integrity/authorization flaw rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (5.9, AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N) rates it MEDIUM with pure integrity impact and no confidentiality/availability effect - consistent with a mass-assignment-class bug (CWE-915) that lets a caller set private action arguments. Note a signal conflict: the vendor chose AV:L, but the description explicitly states the flaw is reachable through AshJsonApi, AshGraphql, or a controller forwarding request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4 - i.e. remotely over the network in typical deployments - so AV:N is arguably more accurate; verify intended vector with the CNA (EEF). The AT:P (attack requirement present) correctly captures that impact is gated on the application actually using a security-relevant private argument, so this is not a universal one-shot. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active exploitation; this is a fix-during-maintenance-window item, prioritized higher only where bulk actions expose private arguments driving authorization/ownership. A vendor patch (ash 3.33.11) is available, which raises remediation priority since defenders can act immediately.

An Elixir application exposes a bulk update or bulk destroy action through AshJsonApi or AshGraphql, and that action uses a private argument (e.g. acting_user_id) referenced by an arg(...) template to drive authorization or record ownership. An attacker submits a parameter map that includes that private argument key; because the bulk base_changeset matches all argument names without a public? check, the attacker-supplied value is applied, overriding the trusted server-side value and enabling privilege escalation or integrity violation. No public proof-of-concept is identified in the provided data.