An improper filter in Ash’s changeset constructor allows a user to override private action arguments, which are intended to be set only by trusted server‑side code. When the parameters are supplied as string keys, Ash retains the private arguments instead of stripping them, enabling the attacker to inject arbitrary values. If the application utilizes those arguments for ownership or authorization checks, this can result in integrity violations or privilege escalation.

The flaw affects applications that use the Ash framework in any Elixir project from version 3.0.0 up to, but not including, 3.29.3. The Ash project is the vendor and the product is the Ash framework, which developers embed to manage changesets and actions.

The CVSS base score of 5.9 indicates moderate severity. EPSS is currently unavailable and the issue is not listed in CISA’s KEV catalog, lowering the immediate perception of threat. The attack vector requires an attacker to submit crafted parameters to an action that declares a private argument, which is typically feasible when user input is passed directly to an Ash changeset. Successful exploitation can allow unauthorized manipulation of protected data or elevation of privileges within the application.