CVE-2026-82745: CWE-284 Improper Access Control in ash-project ash

The vulnerability arises from the ash framework's ETS and Mnesia data layers not enforcing primary key uniqueness on create operations. When a create action is performed with a primary key that already exists, the existing record is overwritten instead of rejected. This allows an actor who can control the primary key value to overwrite existing records, circumventing update action policies. The issue affects ash versions from 0.4.0 before 3.32.2. The intended fix is to reject create requests with duplicate primary keys, only allowing duplicates for keyless resources.

An attacker with the ability to specify primary keys in create actions can overwrite existing records silently, potentially destroying or replacing another entity's data without going through update policies. This improper access control can lead to data integrity issues and unauthorized data modification. The CVSS 4.0 score is 5.9 (medium severity), reflecting local attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves rejecting create actions with duplicate primary keys except for keyless resources. Until an official fix is available, restrict or validate inputs that control primary keys in create actions to prevent overwriting existing records.