CVE-2026-82726
MediumCVSS 6.3Summary
A Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""), causing wildcard matching and global unanchored replacement. The issue affects ash_phoenix from 2.1.26 before 2.3.25.
Risk Assessment
An attacker can access another tenant's data or cause application failure, potentially leading to data isolation breaches and service availability issues.
Recommendation
Update ash_phoenix to version 2.3.25 or later, which matches the root host case-insensitively and only as an exact trailing suffix.
Other vulnerabilities in ash_phoenix
See all- CVE-2026-82727Low
In ash_phoenix (from 1.2.17 before 2.3.25), a vulnerability allows disclosure of sensitive information in error messages. The entire raw submitted param map is written into an exception message, potentially exposing secrets in logs and crash reports.
- CVE-2026-82725Low
In ash_phoenix (from 0.6.0-rc.1 before 2.3.25), a vulnerability allows authorization bypass through user-controlled key. An attacker can filter across non-public relationships, potentially revealing private data.
- CVE-2026-82724High
An incorrect authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. This affects ash_phoenix from 2.1.26 before 2.3.25.
Original NVD description (English source)
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix. This issue affects ash_phoenix: from 2.1.26 before 2.3.25.