CVE-2026-82725
Received Received - Intake

Authorization Bypass in AshPhoenix FilterForm

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data. AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public. This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82725
EUVD
EUVD-2026-68337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_phoenix From 0.6.0-rc.1 (inc) to 2.3.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows attackers to bypass authorization by manipulating filter form parameters to traverse non-public relationships in the AshPhoenix library. The system only checked the final field for publicity, not intermediate relationships, enabling access to private related data through crafted queries.

Detection Guidance

To detect this vulnerability, check if your application uses ash_phoenix versions between 0.6.0-rc.1 and below 2.3.25. Run: gem list ash_phoenix to verify installed versions. Inspect filter form parameters in your application for any attempts to traverse relationships marked as non-public.

Impact Analysis

Attackers could exploit this to access sensitive data they shouldn't see by submitting specially crafted filter forms. This requires no additional authentication beyond access to the filter form, potentially exposing private information like user-authored content or internal records.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating principles of least privilege and data protection. It may result in non-compliance with GDPR's data minimization and security requirements or HIPAA's access control mandates if sensitive health data is exposed through improper filtering.

Mitigation Strategies

Immediately update ash_phoenix to version 2.3.25 or later. If updating is not possible, review and restrict user-controlled filter form parameters to prevent traversal of non-public relationships. Ensure all relationships in filter paths are explicitly marked as public.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart