CVE-2026-75757
HighCVSS 8.3Summary
A vulnerability in ash_admin relying on cookies without validation and integrity checking allows an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. Cookies are matched using an unanchored regular expression.
Risk Assessment
An attacker can hijack an administrator's session and perform actions on their behalf, potentially leading to unauthorized data access or system modification.
Recommendation
It is recommended to upgrade ash_admin to version 1.3.1 or later, which includes a fix that matches cookie names exactly.
Other vulnerabilities in ash_admin
See all- CVE-2026-82722High
A vulnerability in ash_admin allows any client that can reach the admin LiveView to exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers intern atoms from unvalidated client input, and atoms are never garbage collected, leading to a crash.
- CVE-2026-82681Low
A vulnerability in ash_admin allows an attacker who controls a record's string primary key to rewrite the target of AshAdmin's row-action links. Links are built via raw string interpolation without URL-encoding, enabling parameter injection and redirecting admins to unintended actions.
- CVE-2026-82673High
A Path Traversal vulnerability in ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. The browser-supplied filename is not sanitized, allowing writes outside the temporary directory.
- CVE-2026-81853Low
A vulnerability in ash_admin allows authorization bypass through user-controlled keys, turning a record-lookup URL into an equality oracle over sensitive attributes. The primary key decoding does not verify that returned fields are actual primary key fields, enabling brute-force of sensitive values.
- CVE-2026-81852Low
A vulnerability in ash_admin involves the use of a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. The default nonce is a constant known from the repository and is not rotated, allowing its reuse to run unauthorized scripts.
- CVE-2026-77850High
A Stored Cross-site Scripting vulnerability in ash_admin executes attacker-supplied record content as script in an administrator's browser. The RelationshipField and ManagedRelationshipSelectField components render labels without proper escaping.
Original NVD description (English source)
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality. This issue affects ash_admin: from 0.9.1 before 1.3.1.