CVE-2026-82746

Name of the Vulnerable Software and Affected Versions ash versions 3.29.0 through 3.32.1

Description A missing authorization issue allows an actor to update records forbidden by resource policies when using the atomic path of the Ash.update many/4 function. This occurs because Ash.Actions.Update.UpdateMany (located in lib/ash/actions/update/update many.ex) executed atomic statements, such as SQL MERGE, without applying resource policies even when authorize?: true was set. Consequently, the system updated every row matched by primary key, ignoring the policy filters that should have restricted access. This could enable an actor to modify records belonging to other actors or tenants.

Recommendations Update ash to version 3.32.2 or later.