EEF-CVE-2026-81853
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-81853.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-81853.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-81853
- Aliases
-
- CVE-2026-81853
- GHSA-jxr8-hpv2-qp38
- Published
- 2026-08-31T02:31:29Z
- Modified
- 2026-09-08T03:30:04Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
- Details
-
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and:safestill allows any already-interned attribute name. An attacker can therefore encode%{api_token: "guess"}and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time;Map.to_list/1also accepts structs, yielding a bogus__struct__key. The fix rejects any decoded key that is not a real primary-key field.This issue affects ash_admin: from 0.1.0 before 1.3.1.
Configurations
The resource has a composite primary key, and the deployment relies on AshAdmin's authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.
- Database specific
{ "capec_ids": [ "CAPEC-77" ], "cpe_ids": [ "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-639" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Peter Ullrich - REPORTER
-
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / ash_admin
Package
- Name
- ash_admin
- Purl
- pkg:hex/ash_admin