CVE-2026-82745

Name of the Vulnerable Software and Affected Versions ash versions 0.4.0 through 3.32.1

Description An improper access control issue exists when using the ETS or Mnesia data layers. These layers implement the create action as a keyed insert that does not enforce primary-key uniqueness, unlike SQL data layers. An attacker capable of specifying the primary key during a create action can overwrite an existing record by using a key that matches it. This allows the silent destruction and replacement of another entity's data, bypassing the update action and its associated policies.

Recommendations Update to version 3.32.2 or later.