CVE-2026-82732: CWE-20 Improper Input Validation in ash-project ash_typescript

The vulnerability in ash_typescript's TypedController.RequestHandler occurs because Ash.Type.cast_input/3 is used to coerce input values but does not apply declared constraints, which are enforced separately by Ash.Type.apply_constraints/3. Since the request handler never calls apply_constraints, constraints like one_of, max_length, min, max, and match are effectively ignored. This allows attackers to submit values outside the intended allowlist or bounds, bypassing client-side TypeScript type enforcement and potentially leading to privilege or state-machine bypasses. The affected versions are 0.15.0 through versions before 0.18.0.

Attackers can bypass input validation constraints that gate critical logic such as roles, statuses, or sort directions, potentially leading to unauthorized privilege escalation or state-machine bypasses. The vulnerability undermines the integrity of input validation, allowing malicious inputs that should have been rejected to be processed by the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement additional server-side validation to enforce all constraints explicitly, ensuring that inputs conform to declared allowlists and bounds before processing.