PT-2025-36416

CVE-2025-48042

Published

2025-09-07

Updated

2026-09-22

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ash versions prior to 3.5.39

Description An incorrect authorization vulnerability exists in ash, allowing exploitation of incorrectly configured access control security levels. This issue is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex, and program routines Elixir.Ash.Actions.Create.Bulk:run/5, Elixir.Ash.Actions.Destroy.Bulk:run/6, and Elixir.Ash.Actions.Update.Bulk:run/6.

Recommendations Update to ash version 3.5.39 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jonatan Männchen

Zach Daniel

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization