CVE-2026-82725: CWE-639 Authorization Bypass Through User-Controlled Key in ash-project ash_phoenix

The vulnerability in ash_phoenix involves AshPhoenix.FilterForm resolving every relationship hop in a user-supplied path using Ash.Resource.Info.related/2, which includes private relationships. Only the terminal field was checked for publicity, allowing attackers to filter on non-public relationships. Additionally, parse_path_and_field/2 rewrote fields naming relationships into extra path segments, accepting private relationships as filter fields. The unchecked reference was passed to Ash.Query.do_filter/2 without public-only enforcement, enabling an authorization bypass. The fix requires each hop to be resolved with Ash.Resource.Info.public_relationship/2, rejecting non-public hops and enforcing the terminal field to be public.

An attacker with the ability to control filter form parameters can bypass authorization restrictions to infer private related data by filtering across non-public relationships. This could lead to unauthorized disclosure of sensitive data through a boolean oracle mechanism. The CVSS score is low (2.3), indicating limited impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves enforcing public-only checks on each relationship hop in filter paths and requiring the terminal field to be public. Until an official fix is available, avoid exposing filter form parameters that allow relationship traversal or restrict access to trusted users.