CVE-2026-96581 Details
Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.
A vulnerability in the Ash framework under the attribute multitenancy feature allows users to bypass authorization and manipulate records of other tenants. This issue arises in Ash versions 1.22.0 prior to 3.37.2. The vulnerability enables a user to read, overwrite, and take control of another tenant's records by exploiting the 'upsert' functionality in create actions. When a create action with 'upsert' enabled is used, the framework fails to properly scope record conflicts to the correct tenant. As a result, a user can update a record from a different tenant and inadvertently transfer it to their own tenant. This vulnerability is particularly concerning because it bypasses standard read and update policies, creating a risk of unauthorized data access and manipulation.
Users can update their actions to include a tenant-specific upsert condition, ensuring that upserts are properly scoped to the correct tenant. However, this workaround is not effective for the Mnesia data layer, which disregards upsert conditions in the vulnerable Ash versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-96581.html | EEF | AdvisoryBundle |
| https://github.com/ash-project/ash/commit/2333d01ddf37e5909769a513059b27e3183331c5 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash/commit/c9f0cdb31e7c084def05f3f5be69dd7bb7721754 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-96581 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-project ash | >= 1.22.0, < 3.37.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | EEF |