High 7.6Published Oct 26, 2026

CVE-2026-96581An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Updated under an hour ago (Oct 27, 2026, 3:30 PM ET)

Does this affect you?

It affects ash-project ash. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.26%, higher than 17% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ash-project ash

Exploited in the last 30 days

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.

CVSS: 7.6 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.26% (percentile 17)
Assigned by: EEF
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

ash-project ash ash-project:ash	from 1.22.0 before 3.37.2	CNA record

References

References

https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-96581.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-96581	related
https://github.com/ash-project/ash/commit/2333d01ddf37e5909769a513059b27e3183331c5	related
https://github.com/ash-project/ash/commit/c9f0cdb31e7c084def05f3f5be69dd7bb7721754	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.