CVE-2026-82724: CWE-863 Incorrect Authorization in ash-project ash_phoenix

The vulnerability in ash_phoenix involves the SubdomainHook authorization callback being called with a nil tenant because the tenant assignment happens after the callback invocation in the LiveView lifecycle. Specifically, on_mount attaches a handle_params hook to assign the tenant but calls handle_subdomain immediately within on_mount before the tenant is assigned. As a result, authorization gates that depend on tenant information either crash or allow access incorrectly. The fix involves running handle_subdomain inside the handle_params hook with the correct tenant on every navigation. This flaw affects ash_phoenix versions >=2.1.26 and <2.3.25.

Because tenant-scoped access checks receive a nil tenant, authorization gates may either crash or allow unauthorized access, potentially leading to privilege escalation or unauthorized data access within multi-tenant environments. The vulnerability is rated high severity with a CVSS 4.0 score of 7.6, indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not provided an official fix or patch link at this time. Users should monitor for updates from the ash-project and apply any official fixes once available. Until then, review usage of SubdomainHook and tenant assignment logic to avoid relying on tenant values before they are assigned.