The vulnerability arises because the identity tool filter in AshAi.Tool.Execution constructs the filter directly from raw tool arguments as [{key, Map.get(arguments, to_string(key))}]. When a caller supplies a map value as a predicate expression rather than a literal—e.g. {"public_ref": {"not_eq": "<own-ref>"}}—the system interprets it as a filter condition. By combining this with Ash.Query.limit(1) and bulk update or destroy operations, an attacker can target a record they never identified, including any arbitrary row where the key is null or the value does not match. This allows unauthorized modification or deletion of data, leading to loss of data integrity and potential data loss. The weakness is identified as CWE‑639, an Authorization Bypass Through User‑Controlled Key.

The vulnerability affects the ash-project ash_ai software. Affected releases include all versions from 0.6.0 up to, but not including, 1.0.0.

The CVSS score of 7.1 indicates a high severity vulnerability. EPSS data is not available, but the lack of a KEV listing means no known large‑scale exploitation has been documented yet. The likely attack vector is through any interface that allows a caller to supply tool arguments—the attacker can craft operator maps that are interpreted as filter predicates. Successful exploitation requires the attacker to invoke the identity‑configured tool with appropriate privileges, but because the vulnerability lies in the filter construction, it does not require elevated permissions beyond the tool’s normal execution rights. Once the filter is manipulated, the attacker can perform bulk updates or deletes against arbitrary records. Mitigation through patching is strongly recommended to eliminate this authorization bypass.