CVE-2026-82564: CWE-639 Authorization Bypass Through User-Controlled Key in ash-project ash_ai

The vulnerability in ash_ai's AshAi.Tool.Execution module involves the identity_filter/3 function constructing update and destroy filters directly from raw user input arguments as key-value pairs. Since map values are parsed as predicate expressions rather than literals, an attacker can craft inputs such as {"public_ref": {"not_eq": "<own-ref>"}} to bypass identity restrictions and target records they do not own. Additionally, omitting keys results in IS NULL filters that match arbitrary rows. The root cause is the lack of casting identity values to their expected field types, which allows non-scalar inputs to manipulate query predicates. This flaw affects ash_ai versions >=0.6.0 and <1.0.0.

An attacker with limited privileges can bypass authorization controls to update or delete records they are not authorized to access, potentially affecting all rows in the targeted database table. This can lead to unauthorized data modification or destruction, compromising data integrity and application security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves casting each identity value to the field type and rejecting non-scalar inputs to prevent predicate injection. Until an official fix is available, avoid using vulnerable versions or restrict access to trusted users only.