{"uuid": "565e1246-484f-4f23-a9e6-302eaa859c44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-f4hc-ppw9-4hhw", "type": "seen", "source": "https://gist.github.com/alon710/f5ffdc6bd1b277ad08a23759c40e011f", "content": "# CVE-2026-55736: CVE-2026-55736: Mass Assignment / Parameter Pollution in Ash Framework Changeset Path\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55736\n\n## Summary\nA parameter injection vulnerability exists in the Ash framework for Elixir, where untrusted string-keyed maps can bypass the 'public?: false' restriction on action arguments. An attacker can leverage this bypass to inject and overwrite private arguments, resulting in unauthorized data modification or privilege escalation depending on the target application's design.\n\n## TL;DR\nThe Elixir Ash framework failed to check the 'public?' flag on action arguments when processing parameters with string keys or executing atomic updates, allowing unauthorized users to modify private parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915\n- **Attack Vector**: Local\n- **CVSS v4.0**: 5.9 (Medium)\n- **EPSS Score**: 0.00367\n- **Impact**: High Integrity Violation\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the Ash Framework (Elixir) with active resources defining private action arguments (public?: false).\n- **ash**: >= 3.0.0, < 3.29.3 (Fixed in: `3.29.3`)\n\n## Mitigation\n\n- Upgrade the Ash framework library dependency to version 3.29.3 or higher.\n- Sanitize untrusted parameter maps at the application boundary (e.g., Phoenix Controllers/Plugs) to remove keys representing private arguments.\n\n**Remediation Steps:**\n1. Open your Elixir application's 'mix.exs' file.\n2. Update the ':ash' dependency requirement to version '~> 3.29.3'.\n3. Execute 'mix deps.update ash' in your terminal.\n4. Run tests to ensure that existing private arguments function as intended when set programmatically via 'Ash.Changeset.set_private_argument/3'.\n\n## References\n\n- [GHSA-f4hc-ppw9-4hhw: Ash Framework Security Advisory](https://github.com/ash-project/ash/security/advisories/GHSA-f4hc-ppw9-4hhw)\n- [NVD - CVE-2026-55736](https://nvd.nist.gov/vuln/detail/CVE-2026-55736)\n- [Erlang Ecosystem Foundation CNA Record](https://cna.erlef.org/cves/CVE-2026-55736.html)\n- [OSV Entry: EEF-CVE-2026-55736](https://osv.dev/vulnerability/EEF-CVE-2026-55736)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55736) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T02:30:33.000000Z"}