AshDoubleEntry exposes a ULID decoder that treats several different first characters as equivalent, allowing an attacker to represent the same underlying record with multiple distinct identifier strings. This indirect identifier collision can cause the system to read or modify the wrong row, bypass deduplication or idempotency checks, and defeat audit correlation or signature verification performed on the submitted identifier. The weakness stems from improper handling of alternate encoding, classified under CWE‑173.

The affected product is ash-project's ash_double_entry, versions before 1.0.19 (starting from 0.1.0). These versions allow the alternate ULID spellings and are deployed via the ash-project framework.

The CVSS score is 2.1, indicating low severity, and the EPSS score is not available, providing no direct exploitation probability data. It is not listed in the CISA KEV catalog. The likely attack vector is remote via an HTTP or API endpoint that accepts public identifiers; an attacker can supply an alternate spelling to target an arbitrary record. The lack of cryptographic protections on the identifier and missing validation of its canonical form make the vulnerability exploitable without privileged access, but the impact is limited to data integrity and authorization bypass rather than full remote code execution.