ash_phoenix vulnerabilities

In ash_phoenix (from 1.2.17 before 2.3.25), a vulnerability allows disclosure of sensitive information in error messages. The entire raw submitted param map is written into an exception message, potentially exposing secrets in logs and crash reports.

A Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""), causing wildcard matching and global unanchored replacement. The issue affects ash_phoenix from 2.1.26 before 2.3.25.

In ash_phoenix (from 0.6.0-rc.1 before 2.3.25), a vulnerability allows authorization bypass through user-controlled key. An attacker can filter across non-public relationships, potentially revealing private data.

An incorrect authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. This affects ash_phoenix from 2.1.26 before 2.3.25.