Search
Find a vulnerability
Search criteria
14 vulnerabilities found for ash_admin by ash-project
CVE-2026-82722 (GCVE-0-2026-82722)
Vulnerability from nvd – Published: 2026-08-31 02:22 – Updated: 2026-08-31 02:22
VLAI
EPSS
VEX
Title
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82722.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82722 | related |
| https://github.com/ash-project/ash_admin/commit/7… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 731dffa09416d68f4ad3a0b6ee146b285ca0083b
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.PageLive\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/pages/page_live.ex",
"lib/ash_admin/components/resource/show.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.PageLive\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027:handle_event/3"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.PageLive\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/pages/page_live.ex",
"lib/ash_admin/components/resource/show.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.PageLive\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027:handle_event/3"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "731dffa09416d68f4ad3a0b6ee146b285ca0083b",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\u003c/p\u003e\n\u003cp\u003eTwo LiveView event handlers interned atoms from unvalidated client input: \u003ccode\u003eAshAdmin.PageLive\u003c/code\u003e\u0027s \u003ccode\u003eset_actor\u003c/code\u003e built modules from the \u003ccode\u003eresource\u003c/code\u003e/\u003ccode\u003edomain\u003c/code\u003e payload with \u003ccode\u003eModule.concat/1\u003c/code\u003e, and \u003ccode\u003eAshAdmin.Components.Resource.Show\u003c/code\u003e\u0027s \u003ccode\u003ecalculate\u003c/code\u003e converted every submitted form key with \u003ccode\u003eString.to_atom/1\u003c/code\u003e. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted \u003ccode\u003eresource\u003c/code\u003e/\u003ccode\u003edomain\u003c/code\u003e against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\n\nTwo LiveView event handlers interned atoms from unvalidated client input: `AshAdmin.PageLive`\u0027s `set_actor` built modules from the `resource`/`domain` payload with `Module.concat/1`, and `AshAdmin.Components.Resource.Show`\u0027s `calculate` converted every submitted form key with `String.to_atom/1`. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted `resource`/`domain` against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\n\nTwo LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive\u0027s set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show\u0027s calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:22:15.099Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82722.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82722"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/731dffa09416d68f4ad3a0b6ee146b285ca0083b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82722",
"datePublished": "2026-08-31T02:22:15.099Z",
"dateReserved": "2026-08-31T00:59:08.959Z",
"dateUpdated": "2026-08-31T02:22:15.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82681 (GCVE-0-2026-82681)
Vulnerability from nvd – Published: 2026-08-31 02:26 – Updated: 2026-08-31 02:26
VLAI
EPSS
VEX
Title
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links.
The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.
This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.
Severity
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82681.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82681 | related |
| https://github.com/ash-project/ash_admin/commit/8… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.3.0-rc.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
b214535f0cc012e36ca621e643bf8f7b133ba354 , < 8e8ef91e8ba07498053887c6212f8b0f08178df6
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/table.ex",
"lib/ash_admin/components/resource/data_table.ex",
"lib/ash_admin/components/resource/show.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.3.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/table.ex",
"lib/ash_admin/components/resource/data_table.ex",
"lib/ash_admin/components/resource/show.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8e8ef91e8ba07498053887c6212f8b0f08178df6",
"status": "affected",
"version": "b214535f0cc012e36ca621e643bf8f7b133ba354",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.3.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eTable\u003c/code\u003e, \u003ccode\u003eDataTable\u003c/code\u003e, and \u003ccode\u003eShow\u003c/code\u003e components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because \u003ccode\u003ePlug.Conn.Query\u003c/code\u003e resolves duplicate parameters last-wins and \u003ccode\u003eprimary_key\u003c/code\u003e is interpolated last, a stored key such as \u003ccode\u003efoo\u0026amp;action_type=destroy\u003c/code\u003e injects parameters that override the link, so an admin clicking \u003ccode\u003eedit\u003c/code\u003e is sent to a destroy form or an arbitrary resource; a \u003ccode\u003e#\u003c/code\u003e truncates the query into a fragment. The fix builds every link with \u003ccode\u003eURI.encode_query/1\u003c/code\u003e, encoding all interpolated values.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe `Table`, `DataTable`, and `Show` components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because `Plug.Conn.Query` resolves duplicate parameters last-wins and `primary_key` is interpolated last, a stored key such as `foo\u0026action_type=destroy` injects parameters that override the link, so an admin clicking `edit` is sent to a destroy form or an arbitrary resource; a `#` truncates the query into a fragment. The fix builds every link with `URI.encode_query/1`, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo\u0026action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:26:05.357Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82681.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82681"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Query-parameter injection in AshAdmin row-action links via unencoded string primary keys"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82681",
"datePublished": "2026-08-31T02:26:05.357Z",
"dateReserved": "2026-08-30T23:15:02.375Z",
"dateUpdated": "2026-08-31T02:26:05.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82673 (GCVE-0-2026-82673)
Vulnerability from nvd – Published: 2026-08-31 02:33 – Updated: 2026-08-31 02:33
VLAI
EPSS
VEX
Title
Path traversal in AshAdmin file uploads via unsanitized client filename
Summary
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82673.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82673 | related |
| https://github.com/ash-project/ash_admin/commit/4… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.13.7 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
e8f496b6a064ad67dc1cd30433e5921d2192d254 , < 4bb41cb697f3d9be58462d727aed75aba76efc82
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Form\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/form.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Form\u0027:consume_file_uploads/1"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.13.7",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Form\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/form.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Form\u0027:consume_file_uploads/1"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4bb41cb697f3d9be58462d727aed75aba76efc82",
"status": "affected",
"version": "e8f496b6a064ad67dc1cd30433e5921d2192d254",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.13.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Components.Resource.Form.consume_file_uploads/1\u003c/code\u003e builds the destination as \u003ccode\u003ePath.join([tmp_dir, entry.client_name])\u003c/code\u003e and writes it with \u003ccode\u003eFile.cp!/2\u003c/code\u003e. \u003ccode\u003eentry.client_name\u003c/code\u003e is the browser-supplied filename and is not sanitized, and \u003ccode\u003ePath.join/1\u003c/code\u003e does not normalize \u003ccode\u003e..\u003c/code\u003e. An upload named \u003ccode\u003e../../../../var/www/app/priv/static/x.png\u003c/code\u003e therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to \u003ccode\u003e:any\u003c/code\u003e that checks only the extension. The fix strips path components with \u003ccode\u003ePath.basename/1\u003c/code\u003e before joining.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.13.7 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\n\n`AshAdmin.Components.Resource.Form.consume_file_uploads/1` builds the destination as `Path.join([tmp_dir, entry.client_name])` and writes it with `File.cp!/2`. `entry.client_name` is the browser-supplied filename and is not sanitized, and `Path.join/1` does not normalize `..`. An upload named `../../../../var/www/app/priv/static/x.png` therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to `:any` that checks only the extension. The fix strips path components with `Path.basename/1` before joining.\n\nThis issue affects ash_admin: from 0.13.7 before 1.3.1."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\n\nAshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.\n\nThis issue affects ash_admin: from 0.13.7 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:33:10.967Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-483p-rgcq-p5j9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82673.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82673"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/4bb41cb697f3d9be58462d727aed75aba76efc82"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in AshAdmin file uploads via unsanitized client filename"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82673",
"datePublished": "2026-08-31T02:33:10.967Z",
"dateReserved": "2026-08-30T23:15:02.381Z",
"dateUpdated": "2026-08-31T02:33:10.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81853 (GCVE-0-2026-81853)
Vulnerability from nvd – Published: 2026-08-31 02:31 – Updated: 2026-08-31 02:31
VLAI
EPSS
VEX
Title
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81853 | related |
| https://github.com/ash-project/ash_admin/commit/3… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 3c3e905d47f1155dcc1ca3fb347348b05a66065a
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Helpers.decode_primary_key/2\u003c/code\u003e decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and \u003ccode\u003e:safe\u003c/code\u003e still allows any already-interned attribute name. An attacker can therefore encode \u003ccode\u003e%{api_token: \"guess\"}\u003c/code\u003e and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; \u003ccode\u003eMap.to_list/1\u003c/code\u003e also accepts structs, yielding a bogus \u003ccode\u003e__struct__\u003c/code\u003e key. The fix rejects any decoded key that is not a real primary-key field.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\n`AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: \"guess\"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:31:29.547Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81853",
"datePublished": "2026-08-31T02:31:29.547Z",
"dateReserved": "2026-08-30T23:15:02.371Z",
"dateUpdated": "2026-08-31T02:31:29.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81852 (GCVE-0-2026-81852)
Vulnerability from nvd – Published: 2026-08-31 02:29 – Updated: 2026-08-31 02:29
VLAI
EPSS
VEX
Title
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Summary
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Severity
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81852.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81852 | related |
| https://github.com/ash-project/ash_admin/commit/b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.10.8 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
99b8daed7b2f79d82fcd9e89338d41b0e1564aa7 , < bc7a1cdf873b16971a8efec35d085f8bb706314f
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.10.8",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "bc7a1cdf873b16971a8efec35d085f8bb706314f",
"status": "affected",
"version": "99b8daed7b2f79d82fcd9e89338d41b0e1564aa7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application mounts AshAdmin without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e and enforces a nonce-based CSP whose \u003ccode\u003escript-src\u003c/code\u003e allow-lists the default \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e value, and has a separate HTML-injection sink on an admin page.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application mounts AshAdmin without `:csp_nonce_assign_key` and enforces a nonce-based CSP whose `script-src` allow-lists the default `ash_admin-Ed55GFnX` value, and has a separate HTML-injection sink on an admin page."
}
],
"value": "The application mounts AshAdmin without :csp_nonce_assign_key and enforces a nonce-based CSP whose script-src allow-lists the default ash_admin-Ed55GFnX value, and has a separate HTML-injection sink on an admin page."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.10.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\u003c/p\u003e\n\u003cp\u003eWhen mounted without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e, \u003ccode\u003eAshAdmin.Router.ash_admin/2\u003c/code\u003e defaulted the img, style, and script nonces to the literal constant \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e, which \u003ccode\u003eAshAdmin.Layouts\u003c/code\u003e wrote verbatim into the \u003ccode\u003enonce\u003c/code\u003e attribute of its inline \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP \u003ccode\u003escript-src\u003c/code\u003e allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.10.8 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without `:csp_nonce_assign_key`, `AshAdmin.Router.ash_admin/2` defaulted the img, style, and script nonces to the literal constant `ash_admin-Ed55GFnX`, which `AshAdmin.Layouts` wrote verbatim into the `nonce` attribute of its inline `\u003cstyle\u003e` and `\u003cscript\u003e` tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP `script-src` allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline \u003cstyle\u003e and \u003cscript\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:29:14.304Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81852.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81852"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81852",
"datePublished": "2026-08-31T02:29:14.304Z",
"dateReserved": "2026-08-30T23:15:02.378Z",
"dateUpdated": "2026-08-31T02:29:14.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77850 (GCVE-0-2026-77850)
Vulnerability from nvd – Published: 2026-08-31 02:23 – Updated: 2026-08-31 02:23
VLAI
EPSS
VEX
Title
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
Summary
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.
The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.
This issue affects ash_admin: from 0.13.0 before 1.3.1.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-77850.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-77850 | related |
| https://github.com/ash-project/ash_admin/commit/0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.13.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
eb940f4d7d857ca49368ae847f586d01c6f5ad35 , < 07289191ccdac27dd70ab7c6413ed057bc7fdade
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.RelationshipField\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/relationship_field.ex",
"lib/ash_admin/components/resource/managed_relationship_select_field.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.RelationshipField\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/relationship_field.ex",
"lib/ash_admin/components/resource/managed_relationship_select_field.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "07289191ccdac27dd70ab7c6413ed057bc7fdade",
"status": "affected",
"version": "eb940f4d7d857ca49368ae847f586d01c6f5ad35",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\u003c/p\u003e\n\u003cp\u003eThe relationship typeahead components \u003ccode\u003eAshAdmin.Components.Resource.RelationshipField\u003c/code\u003e and \u003ccode\u003eAshAdmin.Components.Resource.ManagedRelationshipSelectField\u003c/code\u003e highlight the matched search term by wrapping it in \u003ccode\u003e\u0026lt;b\u0026gt;\u003c/code\u003e tags and rendering the whole string with \u003ccode\u003ePhoenix.HTML.raw/1\u003c/code\u003e. The highlighted value is the destination record\u0027s \u003ccode\u003elabel_field\u003c/code\u003e, ordinary database content that is often written by lower-privileged users. Because \u003ccode\u003eraw/1\u003c/code\u003e disables output escaping for the entire string, a stored label such as \u003ccode\u003e\u0026lt;img src=x onerror=...\u0026gt;\u003c/code\u003e runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.13.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\n\nThe relationship typeahead components `AshAdmin.Components.Resource.RelationshipField` and `AshAdmin.Components.Resource.ManagedRelationshipSelectField` highlight the matched search term by wrapping it in `\u003cb\u003e` tags and rendering the whole string with `Phoenix.HTML.raw/1`. The highlighted value is the destination record\u0027s `label_field`, ordinary database content that is often written by lower-privileged users. Because `raw/1` disables output escaping for the entire string, a stored label such as `\u003cimg src=x onerror=...\u003e` runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1."
}
],
"value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\n\nThe relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in \u003cb\u003e tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record\u0027s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as \u003cimg src=x onerror=...\u003e runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:23:54.129Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-77850.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-77850"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS in AshAdmin relationship typeahead via unescaped label_field content"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-77850",
"datePublished": "2026-08-31T02:23:54.129Z",
"dateReserved": "2026-08-31T00:45:02.443Z",
"dateUpdated": "2026-08-31T02:23:54.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75757 (GCVE-0-2026-75757)
Vulnerability from nvd – Published: 2026-08-31 02:20 – Updated: 2026-08-31 02:20
VLAI
EPSS
VEX
Title
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Summary
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.
AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.
This issue affects ash_admin: from 0.9.1 before 1.3.1.
Severity
CWE
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-75757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-75757 | related |
| https://github.com/ash-project/ash_admin/commit/e… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.9.1 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
77a43cc4fa04cb59c38fc434568a35a38ecb995a , < e93a3408a85035e1f90275d02bc2470c96095e56
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"assets/js/app.js"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.9.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"assets/js/app.js"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e93a3408a85035e1f90275d02bc2470c96095e56",
"status": "affected",
"version": "77a43cc4fa04cb59c38fc434568a35a38ecb995a",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\u003c/p\u003e\n\u003cp\u003eAshAdmin\u0027s client JavaScript read its state cookies (\u003ccode\u003etenant\u003c/code\u003e, \u003ccode\u003eactor_resource\u003c/code\u003e, \u003ccode\u003eactor_primary_key\u003c/code\u003e, \u003ccode\u003eactor_action\u003c/code\u003e, \u003ccode\u003eactor_domain\u003c/code\u003e, \u003ccode\u003eactor_authorizing\u003c/code\u003e, \u003ccode\u003eactor_paused\u003c/code\u003e) by matching the cookie name with an unanchored regular expression (\u003ccode\u003enew RegExp(name + \"=([^;]+)\")\u003c/code\u003e) against the whole \u003ccode\u003edocument.cookie\u003c/code\u003e. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example \u003ccode\u003exactor_authorizing\u003c/code\u003e) with \u003ccode\u003eDomain=.example.com\u003c/code\u003e that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.9.1 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (`tenant`, `actor_resource`, `actor_primary_key`, `actor_action`, `actor_domain`, `actor_authorizing`, `actor_paused`) by matching the cookie name with an unanchored regular expression (`new RegExp(name + \"=([^;]+)\")`) against the whole `document.cookie`. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example `xactor_authorizing`) with `Domain=.example.com` that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
}
],
"value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-31",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:20:17.985Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75757",
"datePublished": "2026-08-31T02:20:17.985Z",
"dateReserved": "2026-08-30T23:30:01.239Z",
"dateUpdated": "2026-08-31T02:20:17.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82673 (GCVE-0-2026-82673)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:33 – Updated: 2026-08-31 02:33
VLAI
EPSS
VEX
Title
Path traversal in AshAdmin file uploads via unsanitized client filename
Summary
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82673.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82673 | related |
| https://github.com/ash-project/ash_admin/commit/4… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.13.7 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
e8f496b6a064ad67dc1cd30433e5921d2192d254 , < 4bb41cb697f3d9be58462d727aed75aba76efc82
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Form\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/form.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Form\u0027:consume_file_uploads/1"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.13.7",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Form\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/form.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Form\u0027:consume_file_uploads/1"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4bb41cb697f3d9be58462d727aed75aba76efc82",
"status": "affected",
"version": "e8f496b6a064ad67dc1cd30433e5921d2192d254",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.13.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Components.Resource.Form.consume_file_uploads/1\u003c/code\u003e builds the destination as \u003ccode\u003ePath.join([tmp_dir, entry.client_name])\u003c/code\u003e and writes it with \u003ccode\u003eFile.cp!/2\u003c/code\u003e. \u003ccode\u003eentry.client_name\u003c/code\u003e is the browser-supplied filename and is not sanitized, and \u003ccode\u003ePath.join/1\u003c/code\u003e does not normalize \u003ccode\u003e..\u003c/code\u003e. An upload named \u003ccode\u003e../../../../var/www/app/priv/static/x.png\u003c/code\u003e therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to \u003ccode\u003e:any\u003c/code\u003e that checks only the extension. The fix strips path components with \u003ccode\u003ePath.basename/1\u003c/code\u003e before joining.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.13.7 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\n\n`AshAdmin.Components.Resource.Form.consume_file_uploads/1` builds the destination as `Path.join([tmp_dir, entry.client_name])` and writes it with `File.cp!/2`. `entry.client_name` is the browser-supplied filename and is not sanitized, and `Path.join/1` does not normalize `..`. An upload named `../../../../var/www/app/priv/static/x.png` therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to `:any` that checks only the extension. The fix strips path components with `Path.basename/1` before joining.\n\nThis issue affects ash_admin: from 0.13.7 before 1.3.1."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.\n\nAshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.\n\nThis issue affects ash_admin: from 0.13.7 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:33:10.967Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-483p-rgcq-p5j9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82673.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82673"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/4bb41cb697f3d9be58462d727aed75aba76efc82"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in AshAdmin file uploads via unsanitized client filename"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82673",
"datePublished": "2026-08-31T02:33:10.967Z",
"dateReserved": "2026-08-30T23:15:02.381Z",
"dateUpdated": "2026-08-31T02:33:10.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81853 (GCVE-0-2026-81853)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:31 – Updated: 2026-08-31 02:31
VLAI
EPSS
VEX
Title
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81853 | related |
| https://github.com/ash-project/ash_admin/commit/3… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 3c3e905d47f1155dcc1ca3fb347348b05a66065a
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Helpers.decode_primary_key/2\u003c/code\u003e decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and \u003ccode\u003e:safe\u003c/code\u003e still allows any already-interned attribute name. An attacker can therefore encode \u003ccode\u003e%{api_token: \"guess\"}\u003c/code\u003e and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; \u003ccode\u003eMap.to_list/1\u003c/code\u003e also accepts structs, yielding a bogus \u003ccode\u003e__struct__\u003c/code\u003e key. The fix rejects any decoded key that is not a real primary-key field.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\n`AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: \"guess\"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:31:29.547Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81853",
"datePublished": "2026-08-31T02:31:29.547Z",
"dateReserved": "2026-08-30T23:15:02.371Z",
"dateUpdated": "2026-08-31T02:31:29.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81852 (GCVE-0-2026-81852)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:29 – Updated: 2026-08-31 02:29
VLAI
EPSS
VEX
Title
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Summary
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Severity
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81852.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81852 | related |
| https://github.com/ash-project/ash_admin/commit/b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.10.8 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
99b8daed7b2f79d82fcd9e89338d41b0e1564aa7 , < bc7a1cdf873b16971a8efec35d085f8bb706314f
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.10.8",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "bc7a1cdf873b16971a8efec35d085f8bb706314f",
"status": "affected",
"version": "99b8daed7b2f79d82fcd9e89338d41b0e1564aa7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application mounts AshAdmin without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e and enforces a nonce-based CSP whose \u003ccode\u003escript-src\u003c/code\u003e allow-lists the default \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e value, and has a separate HTML-injection sink on an admin page.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application mounts AshAdmin without `:csp_nonce_assign_key` and enforces a nonce-based CSP whose `script-src` allow-lists the default `ash_admin-Ed55GFnX` value, and has a separate HTML-injection sink on an admin page."
}
],
"value": "The application mounts AshAdmin without :csp_nonce_assign_key and enforces a nonce-based CSP whose script-src allow-lists the default ash_admin-Ed55GFnX value, and has a separate HTML-injection sink on an admin page."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.10.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\u003c/p\u003e\n\u003cp\u003eWhen mounted without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e, \u003ccode\u003eAshAdmin.Router.ash_admin/2\u003c/code\u003e defaulted the img, style, and script nonces to the literal constant \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e, which \u003ccode\u003eAshAdmin.Layouts\u003c/code\u003e wrote verbatim into the \u003ccode\u003enonce\u003c/code\u003e attribute of its inline \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP \u003ccode\u003escript-src\u003c/code\u003e allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.10.8 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without `:csp_nonce_assign_key`, `AshAdmin.Router.ash_admin/2` defaulted the img, style, and script nonces to the literal constant `ash_admin-Ed55GFnX`, which `AshAdmin.Layouts` wrote verbatim into the `nonce` attribute of its inline `\u003cstyle\u003e` and `\u003cscript\u003e` tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP `script-src` allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline \u003cstyle\u003e and \u003cscript\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:29:14.304Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81852.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81852"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81852",
"datePublished": "2026-08-31T02:29:14.304Z",
"dateReserved": "2026-08-30T23:15:02.378Z",
"dateUpdated": "2026-08-31T02:29:14.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82681 (GCVE-0-2026-82681)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:26 – Updated: 2026-08-31 02:26
VLAI
EPSS
VEX
Title
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links.
The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.
This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.
Severity
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82681.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82681 | related |
| https://github.com/ash-project/ash_admin/commit/8… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.3.0-rc.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
b214535f0cc012e36ca621e643bf8f7b133ba354 , < 8e8ef91e8ba07498053887c6212f8b0f08178df6
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/table.ex",
"lib/ash_admin/components/resource/data_table.ex",
"lib/ash_admin/components/resource/show.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.3.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/table.ex",
"lib/ash_admin/components/resource/data_table.ex",
"lib/ash_admin/components/resource/show.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8e8ef91e8ba07498053887c6212f8b0f08178df6",
"status": "affected",
"version": "b214535f0cc012e36ca621e643bf8f7b133ba354",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.3.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eTable\u003c/code\u003e, \u003ccode\u003eDataTable\u003c/code\u003e, and \u003ccode\u003eShow\u003c/code\u003e components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because \u003ccode\u003ePlug.Conn.Query\u003c/code\u003e resolves duplicate parameters last-wins and \u003ccode\u003eprimary_key\u003c/code\u003e is interpolated last, a stored key such as \u003ccode\u003efoo\u0026amp;action_type=destroy\u003c/code\u003e injects parameters that override the link, so an admin clicking \u003ccode\u003eedit\u003c/code\u003e is sent to a destroy form or an arbitrary resource; a \u003ccode\u003e#\u003c/code\u003e truncates the query into a fragment. The fix builds every link with \u003ccode\u003eURI.encode_query/1\u003c/code\u003e, encoding all interpolated values.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe `Table`, `DataTable`, and `Show` components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because `Plug.Conn.Query` resolves duplicate parameters last-wins and `primary_key` is interpolated last, a stored key such as `foo\u0026action_type=destroy` injects parameters that override the link, so an admin clicking `edit` is sent to a destroy form or an arbitrary resource; a `#` truncates the query into a fragment. The fix builds every link with `URI.encode_query/1`, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo\u0026action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:26:05.357Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82681.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82681"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Query-parameter injection in AshAdmin row-action links via unencoded string primary keys"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82681",
"datePublished": "2026-08-31T02:26:05.357Z",
"dateReserved": "2026-08-30T23:15:02.375Z",
"dateUpdated": "2026-08-31T02:26:05.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77850 (GCVE-0-2026-77850)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:23 – Updated: 2026-08-31 02:23
VLAI
EPSS
VEX
Title
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
Summary
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.
The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.
This issue affects ash_admin: from 0.13.0 before 1.3.1.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-77850.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-77850 | related |
| https://github.com/ash-project/ash_admin/commit/0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.13.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
eb940f4d7d857ca49368ae847f586d01c6f5ad35 , < 07289191ccdac27dd70ab7c6413ed057bc7fdade
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.RelationshipField\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/relationship_field.ex",
"lib/ash_admin/components/resource/managed_relationship_select_field.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Components.Resource.RelationshipField\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/components/resource/relationship_field.ex",
"lib/ash_admin/components/resource/managed_relationship_select_field.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "07289191ccdac27dd70ab7c6413ed057bc7fdade",
"status": "affected",
"version": "eb940f4d7d857ca49368ae847f586d01c6f5ad35",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\u003c/p\u003e\n\u003cp\u003eThe relationship typeahead components \u003ccode\u003eAshAdmin.Components.Resource.RelationshipField\u003c/code\u003e and \u003ccode\u003eAshAdmin.Components.Resource.ManagedRelationshipSelectField\u003c/code\u003e highlight the matched search term by wrapping it in \u003ccode\u003e\u0026lt;b\u0026gt;\u003c/code\u003e tags and rendering the whole string with \u003ccode\u003ePhoenix.HTML.raw/1\u003c/code\u003e. The highlighted value is the destination record\u0027s \u003ccode\u003elabel_field\u003c/code\u003e, ordinary database content that is often written by lower-privileged users. Because \u003ccode\u003eraw/1\u003c/code\u003e disables output escaping for the entire string, a stored label such as \u003ccode\u003e\u0026lt;img src=x onerror=...\u0026gt;\u003c/code\u003e runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.13.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\n\nThe relationship typeahead components `AshAdmin.Components.Resource.RelationshipField` and `AshAdmin.Components.Resource.ManagedRelationshipSelectField` highlight the matched search term by wrapping it in `\u003cb\u003e` tags and rendering the whole string with `Phoenix.HTML.raw/1`. The highlighted value is the destination record\u0027s `label_field`, ordinary database content that is often written by lower-privileged users. Because `raw/1` disables output escaping for the entire string, a stored label such as `\u003cimg src=x onerror=...\u003e` runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1."
}
],
"value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator\u0027s browser.\n\nThe relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in \u003cb\u003e tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record\u0027s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as \u003cimg src=x onerror=...\u003e runs as JavaScript in the admin\u0027s session as soon as a matching record appears in the dropdown, giving the attacker the admin\u0027s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:23:54.129Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-77850.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-77850"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS in AshAdmin relationship typeahead via unescaped label_field content"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-77850",
"datePublished": "2026-08-31T02:23:54.129Z",
"dateReserved": "2026-08-31T00:45:02.443Z",
"dateUpdated": "2026-08-31T02:23:54.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82722 (GCVE-0-2026-82722)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:22 – Updated: 2026-08-31 02:22
VLAI
EPSS
VEX
Title
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82722.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82722 | related |
| https://github.com/ash-project/ash_admin/commit/7… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 731dffa09416d68f4ad3a0b6ee146b285ca0083b
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.PageLive\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/pages/page_live.ex",
"lib/ash_admin/components/resource/show.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.PageLive\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027:handle_event/3"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.PageLive\u0027",
"\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/pages/page_live.ex",
"lib/ash_admin/components/resource/show.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.PageLive\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027:handle_event/3"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "731dffa09416d68f4ad3a0b6ee146b285ca0083b",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\u003c/p\u003e\n\u003cp\u003eTwo LiveView event handlers interned atoms from unvalidated client input: \u003ccode\u003eAshAdmin.PageLive\u003c/code\u003e\u0027s \u003ccode\u003eset_actor\u003c/code\u003e built modules from the \u003ccode\u003eresource\u003c/code\u003e/\u003ccode\u003edomain\u003c/code\u003e payload with \u003ccode\u003eModule.concat/1\u003c/code\u003e, and \u003ccode\u003eAshAdmin.Components.Resource.Show\u003c/code\u003e\u0027s \u003ccode\u003ecalculate\u003c/code\u003e converted every submitted form key with \u003ccode\u003eString.to_atom/1\u003c/code\u003e. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted \u003ccode\u003eresource\u003c/code\u003e/\u003ccode\u003edomain\u003c/code\u003e against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\n\nTwo LiveView event handlers interned atoms from unvalidated client input: `AshAdmin.PageLive`\u0027s `set_actor` built modules from the `resource`/`domain` payload with `Module.concat/1`, and `AshAdmin.Components.Resource.Show`\u0027s `calculate` converted every submitted form key with `String.to_atom/1`. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted `resource`/`domain` against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.\n\nTwo LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive\u0027s set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show\u0027s calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:22:15.099Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82722.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82722"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/731dffa09416d68f4ad3a0b6ee146b285ca0083b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82722",
"datePublished": "2026-08-31T02:22:15.099Z",
"dateReserved": "2026-08-31T00:59:08.959Z",
"dateUpdated": "2026-08-31T02:22:15.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75757 (GCVE-0-2026-75757)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:20 – Updated: 2026-08-31 02:20
VLAI
EPSS
VEX
Title
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Summary
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.
AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.
This issue affects ash_admin: from 0.9.1 before 1.3.1.
Severity
CWE
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-75757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-75757 | related |
| https://github.com/ash-project/ash_admin/commit/e… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.9.1 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
77a43cc4fa04cb59c38fc434568a35a38ecb995a , < e93a3408a85035e1f90275d02bc2470c96095e56
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"assets/js/app.js"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.9.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"assets/js/app.js"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e93a3408a85035e1f90275d02bc2470c96095e56",
"status": "affected",
"version": "77a43cc4fa04cb59c38fc434568a35a38ecb995a",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\u003c/p\u003e\n\u003cp\u003eAshAdmin\u0027s client JavaScript read its state cookies (\u003ccode\u003etenant\u003c/code\u003e, \u003ccode\u003eactor_resource\u003c/code\u003e, \u003ccode\u003eactor_primary_key\u003c/code\u003e, \u003ccode\u003eactor_action\u003c/code\u003e, \u003ccode\u003eactor_domain\u003c/code\u003e, \u003ccode\u003eactor_authorizing\u003c/code\u003e, \u003ccode\u003eactor_paused\u003c/code\u003e) by matching the cookie name with an unanchored regular expression (\u003ccode\u003enew RegExp(name + \"=([^;]+)\")\u003c/code\u003e) against the whole \u003ccode\u003edocument.cookie\u003c/code\u003e. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example \u003ccode\u003exactor_authorizing\u003c/code\u003e) with \u003ccode\u003eDomain=.example.com\u003c/code\u003e that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.9.1 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (`tenant`, `actor_resource`, `actor_primary_key`, `actor_action`, `actor_domain`, `actor_authorizing`, `actor_paused`) by matching the cookie name with an unanchored regular expression (`new RegExp(name + \"=([^;]+)\")`) against the whole `document.cookie`. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example `xactor_authorizing`) with `Domain=.example.com` that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
}
],
"value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-31",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:20:17.985Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75757",
"datePublished": "2026-08-31T02:20:17.985Z",
"dateReserved": "2026-08-30T23:30:01.239Z",
"dateUpdated": "2026-08-31T02:20:17.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}