TI-2026-56300 Aliases CVE-2026-81638

Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

LOW 10CWE-173Published 2026-09-07 · Updated 2026-09-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID. This issue affects ash_double_entry: from 0.1.0 before 1.0.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00189 8th percentileScored 2026-11-07

Fix Fixed ash_double_entry (ash-project): 1.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash_double_entry	0.1.0 to before 1.0.19	1.0.19	Patch available	CNA

ash_double_entry Vendorash-project Affected 0.1.0 to before 1.0.19 Fixed in 1.0.19 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash_double_entry::::::::	—	—	—

cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash_double_entry (ash-project) Fixed in 1.0.19

Timeline

2026-10-02 Threatist record created from CVE-2026-81638

References

Patch 1

https://github.com/ash-project/ash_double_entry/commit/d3e688d300a581ae214b3ca7d95ef4de63fbb050

Advisory 1

https://github.com/ash-project/ash_double_entry/security/advisories/GHSA-qxp2-vgp9-268q

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences