CVE-2026-81853
Received Received - Intake

Authorization Bypass in Ash Admin via User-Controlled Key

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field. This issue affects ash_admin: from 0.1.0 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-81853
EUVD
EUVD-2026-68330

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash_admin From 0.1.0 (inc) to 1.3.1 (exc)
ash-project ash_admin to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key issue in the ash_admin library. It allows attackers to manipulate record-lookup URLs by injecting arbitrary attribute names into the primary key filter. The AshAdmin.Helpers.decode_primary_key/2 function decodes a composite primary key but fails to validate that the decoded keys match the resource's actual primary-key fields. This turns the lookup into an equality oracle, enabling brute-force attacks on sensitive attributes like API tokens or reset tokens.

Detection Guidance

Check if your system uses ash_admin versions 0.1.0 to 1.3.0. Inspect network traffic for requests containing Base64-encoded composite primary keys in cookies or URLs, particularly targeting AshAdmin record routes. Look for repeated requests with varying sensitive attribute values like API tokens or reset tokens.

Impact Analysis

An attacker could exploit this to bypass authorization and access sensitive data by brute-forcing values of sensitive attributes such as API tokens or password reset tokens. The attack requires network access and low privileges, as the attacker only needs to reach an AshAdmin record route. Once exploited, it enables leaking sensitive data one value at a time.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized data exposure risks non-compliance with data confidentiality and integrity controls required by these regulations.

Mitigation Strategies

Upgrade ash_admin to version 1.3.1 or later immediately. Implement input validation to ensure decoded primary keys only contain valid primary-key fields. Review and restrict access to AshAdmin record routes to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart