PT-2025-36416 · Ash · Ash

Jonatan Männchen + 1 · Published 2025-09-07 · Updated 2025-09-15 · CVE-2025-48042

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ash versions prior to 3.5.39

Description An incorrect authorization vulnerability exists in ash, allowing exploitation of incorrectly configured access control security levels. This issue is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex, and program routines Elixir.Ash.Actions.Create.Bulk:run/5, Elixir.Ash.Actions.Destroy.Bulk:run/6, and Elixir.Ash.Actions.Update.Bulk:run/6.

Recommendations Update to ash version 3.5.39 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-48042

GHSA-JJ4J-X5WW-CWH9

Affected Products

Ash

References · 13

• https://github.com/ash-project/ash/commit/5d1b6a5d00771fd468a509778637527b5218be9a · Patch
• https://github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj4j-x5ww-cwh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48042 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48042 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2025-48042 · Vendor Advisory
• https://github.com/ash-project/ash · Note
• https://t.me/CVEtracker/31918 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1964729119482020345 · Twitter Post
• https://hex.pm/packages/ash · Note
• https://twitter.com/offseq/status/1964909228503539980 · Twitter Post
• https://twitter.com/CVEnew/status/1964724306937532564 · Twitter Post
• https://cna.erlef.org/cves/CVE-2025-48042.html · Note