CVE-2026-82725
Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data. AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public. This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.
How to fix
- ash-project ash_phoenix2.3.25, a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_phoenix | 0.6.0-rc.1 ≤ v < 2.3.25, 06875682999938f607c970e71b6a80af90e18b3d ≤ v < a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b | 2.3.25, a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.