CVE-2026-96581: An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Versions reported by the vendor

Affected version ranges reported by the assigning authority (EEF). Independent of NVD's CPE analysis and usually ahead of it.

• ash-project ash

  • 1.22.0 and later · before 3.37.2affected · semver
  • 2333d01ddf37e5909769a513059b27e3183331c5 and later · before c9f0cdb31e7c084def05f3f5be69dd7bb7721754affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-48044Authorization bypass when bypass policy condition evaluates to true
  34Monitor
• CVE-2025-48043Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
  34Monitor
• CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
  32Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-93477Sep 25, 2026 · Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
  23Monitor
• ← EarlierCVE-2026-101028Oct 9, 2026 · Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
  24Monitor
• ← EarlierCVE-2026-114214Oct 25, 2026 · Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.