CVE-2026-81853
LowCVSS 2.3Summary
A vulnerability in ash_admin allows authorization bypass through user-controlled keys, turning a record-lookup URL into an equality oracle over sensitive attributes. The primary key decoding does not verify that returned fields are actual primary key fields, enabling brute-force of sensitive values.
Risk Assessment
An attacker can guess sensitive values such as API tokens or reset tokens, potentially leading to unauthorized access to accounts and data.
Recommendation
Update ash_admin to version 1.3.1 or later, which rejects decoded keys that are not real primary key fields.
Other vulnerabilities in ash_admin
See all- CVE-2026-82722High
A vulnerability in ash_admin allows any client that can reach the admin LiveView to exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers intern atoms from unvalidated client input, and atoms are never garbage collected, leading to a crash.
- CVE-2026-82681Low
A vulnerability in ash_admin allows an attacker who controls a record's string primary key to rewrite the target of AshAdmin's row-action links. Links are built via raw string interpolation without URL-encoding, enabling parameter injection and redirecting admins to unintended actions.
- CVE-2026-82673High
A Path Traversal vulnerability in ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. The browser-supplied filename is not sanitized, allowing writes outside the temporary directory.
- CVE-2026-81852Low
A vulnerability in ash_admin involves the use of a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. The default nonce is a constant known from the repository and is not rotated, allowing its reuse to run unauthorized scripts.
- CVE-2026-77850High
A Stored Cross-site Scripting vulnerability in ash_admin executes attacker-supplied record content as script in an administrator's browser. The RelationshipField and ManagedRelationshipSelectField components render labels without proper escaping.
- CVE-2026-75757High
A vulnerability in ash_admin relying on cookies without validation and integrity checking allows an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. Cookies are matched using an unanchored regular expression.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field. This issue affects ash_admin: from 0.1.0 before 1.3.1.