CVE-2026-96581

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

EUVD-2026-109637

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

CVE-2026-96581

The ash-project ash framework (versions 1.22.0 before 3.37.2 ) contains an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) within Ash.Actions.Create and Ash.Actions.Create.Bulk. Under attribute multitenancy , the software fails to scope conflicting records to the request'...