The vulnerability is an incorrect authorization flaw that allows attackers to trigger bulk create, destroy, or update actions in the ash library without proper permission checks. This flaw is introduced in the bulk action modules and routines within the Ash framework, enabling an attacker to perform unauthorized modifications to resources. The weakness is identified as CWE‑863 and carries a CVSS score of 7.1, indicating moderate‑to‑high severity for confidentiality, integrity, and availability compromise.

The issue affects all releases of the ash library from the initial version 0.1.0 up to, but not including, 3.5.39. The flaw resides in the files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, and lib/ash/actions/update/bulk.ex, as well as the corresponding Elixir routines. Any build or package based on those releases, particularly those hosted on Hex, is impacted.

The low EPSS score (<1%) indicates a small chance of public exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The description suggests that the flaw is triggered by requests to an ash‑based service, implying a likely network‑based attack vector, though this is inferred rather than explicitly documented. An attacker could exploit the missing authorization checks to perform bulk operations that bypass intended access controls.