CVE-2026-82725 ash-project CVE debrief

Who should care

Users of ash_phoenix, especially those who control filter form parameters, should verify their versions and apply patches. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability in ash_phoenix versions from 0.6.0-rc.1 before 2.3.25. Verification and patch application are crucial to prevent potential exploitation and unauthorized access to private related data.

Technical summary

The ash_phoenix library has an Authorization Bypass Through User-Controlled Key vulnerability. An attacker can filter across relationships the resource author marked non-public, turning returned rows into a boolean oracle over private related data. The issue affects ash_phoenix versions from 0.6.0-rc.1 before 2.3.25. The vulnerability arises from AshPhoenix.FilterForm resolving every relationship hop in the user-supplied path with Ash.Resource.Info.related/2 and only checking the terminal field for publicity.

Defensive priority

Defenders should prioritize verifying affected versions of ash_phoenix and applying the vendor-provided patch.

Recommended defensive actions

• Verify if ash_phoenix versions from 0.6.0-rc.1 before 2.3.25 are in use
• Apply the vendor-provided patch to upgrade to a secure version
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate an Authorization Bypass Through User-Controlled Key vulnerability in ash_phoenix. Verification of affected versions and patch application is recommended. The CVE record and NVD detail page provide the most relevant information. Additional verification tasks are needed due to limited source detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.