CVE-2026-82727
LowCVSS 2.3Summary
In ash_phoenix (from 1.2.17 before 2.3.25), a vulnerability allows disclosure of sensitive information in error messages. The entire raw submitted param map is written into an exception message, potentially exposing secrets in logs and crash reports.
Risk Assessment
Sensitive data such as passwords may be exposed in logs, crash reports, and error pages, potentially leading to data confidentiality breach.
Recommendation
Upgrade ash_phoenix to version 2.3.25 or later, which includes the fix.
Other vulnerabilities in ash_phoenix
See all- CVE-2026-82726Medium
A Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""), causing wildcard matching and global unanchored replacement. The issue affects ash_phoenix from 2.1.26 before 2.3.25.
- CVE-2026-82725Low
In ash_phoenix (from 0.6.0-rc.1 before 2.3.25), a vulnerability allows authorization bypass through user-controlled key. An attacker can filter across non-public relationships, potentially revealing private data.
- CVE-2026-82724High
An incorrect authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. This affects ash_phoenix from 2.1.26 before 2.3.25.
Original NVD description (English source)
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps. This issue affects ash_phoenix: from 1.2.17 before 2.3.25.