CVE-2026-82746: CWE-862 Missing Authorization in ash-project ash

The vulnerability exists in Ash.Actions.Update.UpdateMany where the atomic update_many operation executes as a single atomic statement without applying resource authorization policies properly. Even when authorization is enabled, the operation updates all rows matched by primary key without enforcing policy filters, allowing unauthorized record updates. The fix involves restricting the atomic path to data layers that support changeset filters, authorizing each changeset individually, and merging policy filters to ensure only authorized rows are updated.

An attacker with access to the vulnerable function can update records that should be protected by resource policies, such as records belonging to other users or tenants. This can lead to unauthorized data modification and potential data integrity issues. The CVSS 4.0 score is 5.9 (medium severity), reflecting local attack vector with low complexity but partial impact on integrity and requiring partial user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the atomic update_many path in environments where authorization policies are critical or implement additional access controls outside of Ash.update_many/4 to enforce authorization.