The bug allows a create operation to overwrite an existing record because the ETS and Mnesia layers perform a keyed insert that silently replaces any entry with the same primary key. An attacker who can supply a primary key—such as through a user‑controlled string or integer—can submit a create request that matches an existing key and thereby delete or replace another user's data without going through a formal update action or its authorization checks. This is an Improper Access Control issue that results in unauthorized data modification.

The flaw is present in the Ash project’s data handling library for any version from 0.4.0 up to (but not including) 3.32.2. The affected product is the open‑source Ash framework used for building Elixir applications.

The CVSS score of 5.9 indicates moderate severity, and there is no EPSS data available, so the likelihood of exploitation is currently unknown. The issue is not listed in CISA’s KEV catalog. An actor who can control the primary key for a create request—typically via an exposed API endpoint—can readily exploit the flaw; public or internal users could trigger it if the API does not enforce primary‑key uniqueness.