{"metadata": {"vulnerability": "CVE-2026-55736", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-17T10:44:34.365Z", "date_only": false, "value": "2026-06-17T10:44:34.365Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55736", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-23T18:00:51Z", "date_only": false, "value": "2026-06-23T18:00:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ash-project/ash/security/advisories/GHSA-f4hc-ppw9-4hhw", "record": "CVE-2026-55736", "field": "creation_timestamp", "uuid": "2da61662-3ac2-4d0a-9646-ed931b300472", "url": "https://github.com/ash-project/ash/security/advisories/GHSA-f4hc-ppw9-4hhw"}, {"timestamp": "2026-06-23T18:21:13.033Z", "date_only": false, "value": "2026-06-23T18:21:13.033Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55736", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-23T19:17:12Z", "date_only": false, "value": "2026-06-23T19:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F4HC-PPW9-4HHW", "record": "GHSA-F4HC-PPW9-4HHW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-23T19:17:12.287Z", "date_only": false, "value": "2026-06-23T19:17:12.287", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55736", "record": "FKIE_CVE-2026-55736", "field": "published"}, {"timestamp": "2026-06-23T20:59:41.916Z", "date_only": false, "value": "2026-06-23T20:59:41.916241Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moyc6ulhaj2l", "record": "CVE-2026-55736", "field": "creation_timestamp", "uuid": "713da0b3-2009-48ce-900a-1a36177c19d3", "content": "CVE-2026-55736 - Private action arguments can be set by user input in Ash\nCVE ID : CVE-2026-55736\n \n Published : June 23, 2026, 6:21 p.m. | 1\u00a0hour, 23\u00a0minutes ago\n \n Description : Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in a...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3moyc6ulhaj2l"}, {"timestamp": "2026-07-09T14:53:04.134Z", "date_only": false, "value": "2026-07-09T14:53:04.134939Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55736", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-09T14:53:04.134Z", "date_only": false, "value": "2026-07-09T14:53:04.134939Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55736", "record": "FKIE_CVE-2026-55736", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-09T14:53:33.529Z", "date_only": false, "value": "2026-07-09T14:53:33.529Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55736", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-09T16:16:45.123Z", "date_only": false, "value": "2026-07-09T16:16:45.123", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55736", "record": "FKIE_CVE-2026-55736", "field": "lastModified"}, {"timestamp": "2026-07-10T04:34:23.070Z", "date_only": false, "value": "2026-07-10T04:34:23.070Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55736", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-10T04:34:23.070Z", "date_only": false, "value": "2026-07-10T04:34:23.070Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-55736", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T19:53:36Z", "date_only": false, "value": "2026-09-24T19:53:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F4HC-PPW9-4HHW", "record": "GHSA-F4HC-PPW9-4HHW", "field": "published"}, {"timestamp": "2026-09-24T19:53:36Z", "date_only": false, "value": "2026-09-24T19:53:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F4HC-PPW9-4HHW", "record": "GHSA-F4HC-PPW9-4HHW", "field": "modified"}, {"timestamp": "2026-09-25T02:30:33Z", "date_only": false, "value": "2026-09-25T02:30:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/f5ffdc6bd1b277ad08a23759c40e011f", "record": "CVE-2026-55736", "field": "creation_timestamp", "uuid": "8845b20f-bfdb-43a1-a945-d75e2a8db3db", "content": "# CVE-2026-55736: CVE-2026-55736: Mass Assignment / Parameter Pollution in Ash Framework Changeset Path\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55736\n\n## Summary\nA parameter injection vulnerability exists in the Ash framework for Elixir, where untrusted string-keyed maps can bypass the 'public?: false' restriction on action arguments. An attacker can leverage this bypass to inject and overwrite private arguments, resulting in unauthorized data modification or privilege escalation depending on the target application's design.\n\n## TL;DR\nThe Elixir Ash framework failed to check the 'public?' flag on action arguments when processing parameters with string keys or executing atomic updates, allowing unauthorized users to modify private parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915\n- **Attack Vector**: Local\n- **CVSS v4.0**: 5.9 (Medium)\n- **EPSS Score**: 0.00367\n- **Impact**: High Integrity Violation\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the Ash Framework (Elixir) with active resources defining private action arguments (public?: false).\n- **ash**: >= 3.0.0, < 3.29.3 (Fixed in: `3.29.3`)\n\n## Mitigation\n\n- Upgrade the Ash framework library dependency to version 3.29.3 or higher.\n- Sanitize untrusted parameter maps at the application boundary (e.g., Phoenix Controllers/Plugs) to remove keys representing private arguments.\n\n**Remediation Steps:**\n1. Open your Elixir application's 'mix.exs' file.\n2. Update the ':ash' dependency requirement to version '~> 3.29.3'.\n3. Execute 'mix deps.update ash' in your terminal.\n4. Run tests to ensure that existing private arguments function as intended when set programmatically via 'Ash.Changeset.set_private_argument/3'.\n\n## References\n\n- [GHSA-f4hc-ppw9-4hhw: Ash Framework Security Advisory](https://github.com/ash-project/ash/security/advisories/GHSA-f4hc-ppw9-4hhw)\n- [NVD - CVE-2026-55736](https://nvd.nist.gov/vuln/detail/CVE-2026-55736)\n- [Erlang Ecosystem Foundation CNA Record](https://cna.erlef.org/cves/CVE-2026-55736.html)\n- [OSV Entry: EEF-CVE-2026-55736](https://osv.dev/vulnerability/EEF-CVE-2026-55736)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55736) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/f5ffdc6bd1b277ad08a23759c40e011f"}]}