This vulnerability (CVE-2025-48042) in ash-project's ash software arises from incorrect authorization controls in bulk action modules (create, destroy, update). The affected code files include lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, and lib/ash/actions/update/bulk.ex, specifically in the Elixir modules handling bulk actions. Versions prior to 3.5.39 are impacted. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, high impact on integrity, and low impact on availability. There is no vendor advisory or patch link provided, so patch status is unknown.

Successful exploitation could allow unauthorized users with limited privileges to perform bulk create, update, or destroy actions that they should not be authorized to execute, potentially leading to unauthorized data modification. The integrity impact is high, while availability and confidentiality impacts are low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected bulk action functionalities to trusted users only and monitor for unusual activity related to these operations. Avoid deploying affected versions in sensitive environments if possible.