CVE-2026-82739
Received Received - Intake

Information Disclosure in Ash Framework

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value. This issue affects ash: from 2.17.20 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82739
EUVD
EUVD-2026-68944

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash From 2.17.20 (inc) to 3.32.2 (exc)
ash_project ash From 2.17.20 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in the Ash framework's Ash.Resource.Validation.Confirm module. It allows authenticated users to read the stored value of a confirmed field by submitting an incorrect confirmation value and extracting the stored data from the validation error message. The flaw occurs because error messages include the actual stored field value instead of the actor-supplied confirmation.

Detection Guidance

To detect this vulnerability, check if your Ash framework version is between 2.17.20 and 3.32.1. Review error messages in atomic update actions with confirm validation for exposed sensitive data. Test by submitting incorrect confirmations and inspecting error responses for stored field values.

Impact Analysis

This vulnerability primarily impacts confidentiality by allowing attackers to read sensitive data stored in confirmed fields. It requires an authenticated user with permission to run update actions containing confirm validation. The impact is limited to applications exposing atomic update actions with confirm validation over an HTTP boundary.

Mitigation Strategies

Upgrade Ash framework to version 3.32.2 or later. Review and update any atomic update actions using confirm validation to ensure error messages do not expose sensitive data. Apply field policies to restrict access to confirmed attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart