This vulnerability (CVE-2025-48042) in ash-project ash involves incorrect authorization (CWE-863) caused by misconfigured access control security levels in bulk action modules (create, destroy, update) within specific program files and routines. It affects versions prior to 3.5.39, allowing potentially unauthorized actions due to insufficient access control enforcement. The CVSS 4.0 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, high impact on integrity, and low impact on availability.

The vulnerability allows an attacker with low privileges to perform unauthorized bulk create, destroy, or update operations due to incorrect authorization checks. This could lead to unauthorized modification or deletion of data, impacting data integrity. There is no indication of impact on confidentiality or availability beyond low impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to affected functionalities to trusted users only and review access control configurations carefully to minimize exposure.