CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered. Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation. The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option. This issue affects ash: from 2.17.15 before 3.33.11.

• CWE-915

• https://cna.erlef.org/cves/CVE-2026-93477.html
• https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
• https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df
• https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j
• https://osv.dev/vulnerability/EEF-CVE-2026-93477
• https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93455django-page-cms through 2.0.13 fails to properly validate pa…6.5
• CVE-2026-93456django-page-cms through 2.0.13 exempts five admin mutation v…8.2
• CVE-2026-9346A flaw has been found in Edimax EW-7438RPn up to 1.31. This …8.8
• CVE-2026-93467The OAKlouds developed by HGiga has a Insecure Deserializati…9.8
• CVE-2026-93468The OAKlouds developed by HGiga has an Arbitrary File Read v…7.5
• CVE-2026-9347A vulnerability has been found in Edimax EW-7438RPn up to 1.…6.3
• CVE-2026-9348A vulnerability was found in Edimax EW-7438RPn up to 1.31. A…8.8
• CVE-2026-93485Improper neutralization of input during web page generation …7.1
• CVE-2026-93488A flaw was found in Netty. SpdySessionHandler accepts an unl…7.5
• CVE-2026-9349A vulnerability was determined in calcom cal.diy up to 4.9.4…5.5
• CVE-2026-93491A flaw was found in Netty's HttpServerCodec. A remote, unaut…7.5
• CVE-2026-93492A flaw was found in Netty's HTTP/2 HpackEncoder. A remote at…5.3