CVE-2026-82681
Received Received - Intake

Stored XSS in Ash Admin via Unencoded Primary Key

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values. This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82681
EUVD
EUVD-2026-68327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.3.0-rc.0 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper encoding issue in the ash_admin library where user-controlled string primary keys are not properly escaped in URLs. Attackers can craft primary keys with malicious query parameters like 'foo&action_type=destroy' to manipulate row-action links in the admin interface. When an admin clicks a link for such a record, the injected parameters override the intended action, redirecting the admin to unintended resources or actions.

Detection Guidance

To detect this vulnerability, inspect AshAdmin components for improper URL encoding in row-action links. Check if primary keys or other user-controlled values are directly interpolated into URLs without encoding. Review DataTable, Table, and Show components for raw string concatenation in URL generation.

Impact Analysis

An attacker could trick an admin into clicking a malicious link that performs unintended actions like deleting records or accessing unauthorized resources. While the attacker doesn't execute the action directly, they manipulate the admin into doing so through UI confusion. The impact is limited to UI-driven actions rather than direct data loss.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling unauthorized actions through manipulated admin interfaces. If an attacker tricks an admin into clicking a malicious link, it may lead to unintended data exposure or modification, violating confidentiality or integrity requirements. However, the vulnerability itself does not directly handle or expose sensitive data.

Mitigation Strategies

Upgrade AshAdmin to version 1.3.1 or later. Ensure all interpolated values in URLs are encoded using URI.encode_query/1 or Base.url_encode64/2. Replace raw string concatenation in DataTable, Table, and Show components with the new admin_path/2 helper function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart