Threat Intelligence Database

CVE-2026-82725 is an authorization bypass vulnerability in ash-project's ash_phoenix component. It allows an attacker controlling filter form parameters to access private related data by filtering across relationships marked non-public. The vulnerability arises because the filtering logic resolves user-supplied relationship paths without enforcing public-only checks on intermediate relationships, only on the terminal field. This issue affects versions from 0.6.0-rc.1 up to but not including 2.3.25.

CVE-2026-82724 is an incorrect authorization vulnerability in ash-project's ash_phoenix component. The issue arises because the SubdomainHook authorization callback is invoked with a nil tenant, causing tenant-scoped access checks to fail. This happens due to the tenant assignment occurring after the authorization check, leading to either crashes or permissive access. The vulnerability affects versions from 2.1.26 up to but not including 2.3.25.

CVE-2026-82726 is a medium severity vulnerability in ash-project's ash_phoenix component. It involves a permissive regular expression used to parse the Host header, allowing a remote client to manipulate tenant selection or degrade requests by sending crafted Host headers. The root host pattern was interpolated unsafely, causing unintended matches and case sensitivity issues. This affects versions from 2.1.26 up to but not including 2.3.25.

CVE-2026-82727 is a vulnerability in ash-project's ash_phoenix component where error messages generated during form processing leak sensitive information. Specifically, when a union sub-form receives an unexpected _union_type value, the entire submitted parameter map, including secrets like passwords, is embedded in the exception message. This sensitive data is exposed in logs, crash reports, and developer error pages because the message bypasses Phoenix's parameter filtering. The issue affects versions from 1.2.17 up to but not including 2.3.25.