This vulnerability (CVE-2025-48042) in ash-project ash arises from incorrect authorization controls in bulk action routines for create, update, and destroy operations. The affected code includes lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex, and the corresponding Elixir module functions. The flaw allows exploitation of improperly configured access control security levels, potentially permitting unauthorized actions. It impacts all versions from 0.1.0 before 3.5.39. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, with high impact on integrity and low impact on availability. No vendor advisory or patch information is currently available.

The vulnerability allows unauthorized users to perform bulk create, update, or destroy actions due to incorrect authorization checks. This can lead to unauthorized modification or deletion of data, impacting data integrity. The high CVSS score reflects significant risk from exploitation, although no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected functionalities and monitor for suspicious activity related to bulk operations. Avoid deploying affected versions in sensitive environments if possible.