The GitHub Advisory Database posted a notice on 12 November 2026 about a flaw in Action Pack, part of Ruby on Rails. Called with a block, ActionController::Parameters#each_key returned the plain hash of request data, not the guarded Parameters object. That hash has no permitted? check, so mass assignment, which sets many model fields at once, accepted it. The advisory says a remote attacker with no login could set fields the app forbids, such as an authorization flag.
The advisory links this to CVE-2020-8164. That earlier repair handled three sibling methods, and each_key was the one left out. An app is affected only if it passes each_key's return value, called with a block, to mass assignment. The advisory says Rails' own code does not do this. Fixed releases are v8.0.5.2 and v8.1.4.1. The advisory does not say anyone has attacked the flaw.
A version scan will flag the affected Rails gems, but it cannot show whether your own code passes each_key's return value to mass assignment. Teams need both the upgrade and a code review. For any code that relies on that return value, the advisory says to stop using it and give mass assignment the permitted Parameters object.