CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered. Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation. The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option. This issue affects ash: from 2.17.15 before 3.33.11.

• CWE-915

• https://cna.erlef.org/cves/CVE-2026-93477.html
• https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
• https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df
• https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j
• https://osv.dev/vulnerability/EEF-CVE-2026-93477
• https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93467The OAKlouds developed by HGiga has a Insecure Deserializati…9.8
• CVE-2026-93468The OAKlouds developed by HGiga has an Arbitrary File Read v…7.5
• CVE-2026-9347A vulnerability has been found in Edimax EW-7438RPn up to 1.…6.3
• CVE-2026-93471Improper Handling of Highly Compressed Data (Data Amplificat…8.7
• CVE-2026-93474Charging station authentication identifiers are publicly acc…6.5
• CVE-2026-93475The X.509 parser in NetX Secure accepts an RSA public key of…9.3
• CVE-2026-93479A vulnerability exists in NGINX Plus and NGINX Open Source w…8.1
• CVE-2026-9348A vulnerability was found in Edimax EW-7438RPn up to 1.31. A…8.8
• CVE-2026-93483In Znuny through 7.3.6, an attacker can bypass specific stan…9.5
• CVE-2026-93484Znuny through 7.3.6 constructs a ticket-search database quer…8.6
• CVE-2026-93485Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-93487In affected versions of Octopus Server, incorrect validation…7.1