CVE-2026-82724
Received Received - Intake

Incorrect Authorization in AshPhoenix via SubdomainHook

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation. This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82724
EUVD
EUVD-2026-68336

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash_project ash_phoenix From 2.1.26 (inc) to 2.3.25 (exc)
ash-project ash_phoenix From 2.1.26 (inc) to 2.3.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in the ash_phoenix library where the SubdomainHook authorization callback is invoked with a nil tenant value. This happens because the tenant assignment occurs after the handle_subdomain callback executes, causing tenant-scoped access checks to fail. The authorization gate evaluates nil instead of the actual tenant, allowing unauthorized cross-tenant access.

Detection Guidance

To detect this vulnerability, check if your system uses ash_phoenix versions between 2.1.26 and 2.3.24. Inspect LiveView applications using SubdomainHook for tenant-based authorization. Verify if handle_subdomain is called with a nil tenant during on_mount. Look for unauthorized cross-tenant access attempts in logs.

Impact Analysis

This vulnerability allows unauthorized users to access LiveViews for tenants they do not belong to. It bypasses tenant-based authorization logic, potentially leading to data exposure or unauthorized actions. The impact includes high confidentiality and integrity risks due to the ability to access restricted resources.

Compliance Impact

This vulnerability can lead to violations of data protection regulations like GDPR and HIPAA by allowing unauthorized access to sensitive tenant data. It undermines access control requirements, potentially resulting in non-compliance with privacy and security standards that mandate strict tenant isolation.

Mitigation Strategies

Update the ash_phoenix library to version 2.3.25 or later to ensure the tenant is correctly assigned during authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart