CVE-2026-81853: CWE-639 Authorization Bypass Through User-Controlled Key in ash-project ash_admin

The vulnerability in ash_admin involves the decode_primary_key/2 function which decodes a composite primary key from Base64 plus ETF format and returns the resulting map as a lookup filter without verifying that the keys correspond strictly to the resource's primary key fields. Although deserialization limits size and blocks new atoms and functions, it does not restrict which keys are returned, allowing an attacker to inject arbitrary attribute keys such as api_token. This enables an attacker to perform an equality oracle attack by brute forcing sensitive attributes one guess at a time. The fix involves rejecting any decoded key that is not a legitimate primary key field.

An attacker with at least low privileges can exploit this vulnerability to bypass authorization controls by manipulating the lookup filter with arbitrary keys, potentially allowing brute-force guessing of sensitive attributes like API tokens or reset tokens. This could lead to unauthorized access to sensitive information. However, the overall impact is rated low due to the required privileges and the nature of the attack.

No official patch or remediation level has been published yet. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict access to the affected functionality to trusted users only and consider additional application-layer controls to detect or prevent brute-force attempts on sensitive attributes.