CVE-2026-70395: ash 1.52.0-rc.11 to before 3.31.1

Affected technology

ash · 1.52.0-rc.11 to before 3.31.1
ash-project

ash · 571c138140e71cea24005189f45d7a63c8d2ed20 to before 09f42593035bceb0f6153dd7ee45cc49d108300a
ash-project

Component: 'Elixir.Ash.Actions.ManagedRelationships', 'Elixir.Ash.Changeset'
Function: 'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3, 'Elixir.Ash.Changeset':manage_relationship/4
File: lib/ash/actions/managed_relationships.ex, lib/ash/changeset/changeset.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

An attacker can forge a relationship to a record they cannot name, and to recover the secret value used to look it up. Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as low; availability impact as none.