Answer in brief
CVE-2026-82745 records a Medium severity (CVSS 5.9) vulnerability in ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness. The current sources do not mark it as known exploited. The current feed maps ash-project/ash (generic), ash-project/ash (generic), ash-project/ash-project/ash (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash (generic), ash-project/ash (generic), ash-project/ash-project/ash (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ashgeneric | >=6dc699d8a683d542812b34a8c104cc90164add3a <912e243196017c2a812c25905c2b1cc3bbb843fc | 912e243196017c2a812c25905c2b1cc3bbb843fc |
| ash-project/ashgeneric | >=0.4.0 <3.32.2 | 3.32.2 |
| ash-project/ash-project/ashgeneric | >=6dc699d8a683d542812b34a8c104cc90164add3a <912e243196017c2a812c25905c2b1cc3bbb843fc | 912e243196017c2a812c25905c2b1cc3bbb843fc |
Published upstream
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 1, 2026
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources. This issue affects ash: from 0.4.0 before 3.32.2.
Quoted source text, attributed separately from HOL analysis.