CVE-2026-82746: Ash Update Many Missing Atomic Authorization

Ash.Actions.Update.UpdateMany executes atomic updates directly without evaluating authorization policies or applying policy filters to the changesets.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Elixir
greprules fetch cve-2026-82746-ash-update-many-missing-atomic-authorization --engine opengrep

Description

Ash.Actions.Update.UpdateMany executes atomic updates directly without evaluating authorization policies or applying policy filters to the changesets.