EEF-CVE-2026-82725

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-82725.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-82725.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-82725

Aliases

CVE-2026-82725
GHSA-7xhg-xphm-f458

Published

2026-08-31T03:09:25.850Z

Modified

2026-08-31T03:25:37.925020554Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Details

Summary

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.

AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.

This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.

Configuration

The resource exposes an AshPhoenix.FilterForm whose params the attacker controls, and has a non-public relationship to data that should not be filterable.

Database specific

{
    "cpe_ids": [
        "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
    ],
    "capec_ids": [
        "CAPEC-77"
    ],
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Credits

- Peter Ullrich - FINDER
- Peter Ullrich - REPORTER
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
- Jonatan Männchen / EEF - COORDINATOR

Affected packages

Hex / ash_phoenix

Package

Name: ash_phoenix
Purl: pkg:hex/ash_phoenix

Affected ranges

Type: SEMVER
Events: Introduced

0.6.0-rc.1

Fixed

2.3.25

Affected versions

0.*

0.6.0-rc.1

0.6.0-rc.2

0.6.0-rc.3

0.6.0-rc.4

0.6.0-rc.5

0.6.0-rc.6

0.6.0-rc.7

0.7.0

0.7.1

0.7.2-rc.0

0.7.2-rc.1

0.7.2-rc.2

0.7.3

0.7.4

0.7.5

0.7.6-rc.0

0.7.7

1.*

1.0.0-pre.0

1.0.0-pre.1

1.0.0-pre.2

1.0.0-rc.0

1.0.0-rc.1

1.1.0-rc.0

1.1.0-rc.1

1.1.0-rc.2

1.1.0-rc.3

1.1.0

1.1.1

1.1.2

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

1.2.15

1.2.16

1.2.17

1.2.18

1.2.19

1.2.20

1.2.21

1.2.22

1.2.23

1.2.24

1.2.25

1.2.26

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

2.*

2.0.0-rc.0

2.0.0-rc.1

2.0.0-rc.2

2.0.0-rc.3

2.0.0-rc.4

2.0.0-rc.5

2.0.0-rc.6

2.0.0-rc.7

2.0.0-rc.8

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.1.19

2.1.20

2.1.21

2.1.22

2.1.23

2.1.24

2.1.25

2.1.26

2.2.0

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.15

2.3.16

2.3.17

2.3.18

2.3.19

2.3.20

2.3.21

2.3.22

2.3.23

2.3.24

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-82725.json"

Git / github.com/ash-project/ash_phoenix

Affected ranges

Type: GIT
Repo: https://github.com/ash-project/ash_phoenix
Events: Introduced

06875682999938f607c970e71b6a80af90e18b3d

Fixed

a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b

Affected versions

v0.*

v0.6.0-rc.1

v0.6.0-rc.2

v0.6.0-rc.3

v0.6.0-rc.4

v0.6.0-rc.5

v0.6.0-rc.6

v0.6.0-rc.7

v0.7.0

v0.7.1

v0.7.2-rc.0

v0.7.2-rc.1

v0.7.2-rc.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6-rc.0

v0.7.7

v1.*

v1.0.0-rc.0

v1.0.0-rc.1

v1.1.0

v1.1.0-rc.0

v1.1.0-rc.1

v1.1.0-rc.2

v1.1.0-rc.3

v1.1.1

v1.1.2

v1.2.0

v1.2.1

v1.2.10

v1.2.11

v1.2.12

v1.2.13

v1.2.14

v1.2.15

v1.2.16

v1.2.17

v1.2.18

v1.2.19

v1.2.2

v1.2.20

v1.2.21

v1.2.22

v1.2.23

v1.2.24

v1.2.25

v1.2.26

v1.2.3

v1.2.4

v1.2.5

v1.2.6

v1.2.7

v1.2.8

v1.2.9

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v2.*

v2.0.0-rc.0

v2.0.0-rc.1

v2.0.0-rc.2

v2.0.0-rc.3

v2.0.0-rc.4

v2.0.0-rc.5

v2.0.0-rc.6

v2.0.0-rc.7

v2.0.0-rc.8

v2.0.1

v2.0.2

v2.0.3

v2.1.1

v2.1.10

v2.1.11

v2.1.12

v2.1.14

v2.1.15

v2.1.16

v2.1.17

v2.1.18

v2.1.19

v2.1.20

v2.1.21

v2.1.22

v2.1.23

v2.1.24

v2.1.25

v2.1.26

v2.1.3

v2.1.4

v2.1.5

v2.1.6

v2.1.7

v2.1.8

v2.1.9

v2.2.0

v2.3.0

v2.3.1

v2.3.10

v2.3.11

v2.3.12

v2.3.13

v2.3.14

v2.3.15

v2.3.16

v2.3.17

v2.3.18

v2.3.19

v2.3.2

v2.3.20

v2.3.21

v2.3.22

v2.3.23

v2.3.24

v2.3.3

v2.3.4

v2.3.5

v2.3.6

v2.3.7

v2.3.8

v2.3.9

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-82725.json"