CVE-2026-82739 (GCVE-0-2026-82739)

Vulnerability from cvelistv5 – Published: 2026-09-01 03:27 – Updated: 2026-09-01 12:44
VLAI
Title
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value. This issue affects ash: from 2.17.20 before 3.32.2.
Severity
2.1 (Low)
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:43 UTC
CWE
  • CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
Impacted products
Vendor Product Version CPE status
ash-project ash Affected: 2.17.20 , < 3.32.2 (semver)
    cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Create a notification for this product.
ash-project ash Affected: fadecf3ee95640bd3bc7298df4799e0375537fd2 , < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b (git)
    cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jonatan Männchen / EEF Peter Ullrich Zach Daniel / Ash Project Peter Ullrich
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82739",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:43:57.417588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:44:21.482Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/resource/validation/confirm.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "2.17.20",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/resource/validation/confirm.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
              "status": "affected",
              "version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "versionStartIncluding": "2.17.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Resource.Validation.Confirm\u003c/code\u003e\u0027s atomic implementation (\u003ccode\u003eatomic/2\u003c/code\u003e in \u003ccode\u003elib/ash/resource/validation/confirm.ex\u003c/code\u003e) built the mismatch error with its \u003ccode\u003evalue\u003c/code\u003e set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, \u003ccode\u003evalue\u003c/code\u003e resolves through \u003ccode\u003eatomic_ref/2\u003c/code\u003e to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.20 before 3.32.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\n`Ash.Resource.Validation.Confirm`\u0027s atomic implementation (`atomic/2` in `lib/ash/resource/validation/confirm.ex`) built the mismatch error with its `value` set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, `value` resolves through `atomic_ref/2` to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
            }
          ],
          "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-54",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-54 Query System for Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T03:27:58.165Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ash.Resource.Validation.Confirm leaks a confirmed field\u0027s stored value in the atomic mismatch error"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82739",
    "datePublished": "2026-09-01T03:27:58.165Z",
    "dateReserved": "2026-08-31T00:59:10.002Z",
    "dateUpdated": "2026-09-01T12:44:21.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82739",
      "date": "2026-09-20",
      "epss": "0.00126",
      "percentile": "0.02673"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
                ],
                "packageName": "ash",
                "packageURL": "pkg:hex/ash",
                "product": "ash",
                "programFiles": [
                  "lib/ash/resource/validation/confirm.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
                  }
                ],
                "repo": "https://github.com/ash-project/ash",
                "vendor": "ash-project",
                "versions": [
                  {
                    "lessThan": "3.32.2",
                    "status": "affected",
                    "version": "2.17.20",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
                ],
                "packageName": "ash-project/ash",
                "packageURL": "pkg:github/ash-project/ash",
                "product": "ash",
                "programFiles": [
                  "lib/ash/resource/validation/confirm.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
                  }
                ],
                "repo": "https://github.com/ash-project/ash",
                "vendor": "ash-project",
                "versions": [
                  {
                    "lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
                    "status": "affected",
                    "version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
          }
        ],
        "id": "CVE-2026-82739",
        "lastModified": "2026-09-01T21:15:00.147",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-82739",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:43:57.417588Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-01T04:18:03.580",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-209"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-82739",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-01T12:43:57.417588Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-01T12:44:16.753Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
              ],
              "packageName": "ash",
              "packageURL": "pkg:hex/ash",
              "product": "ash",
              "programFiles": [
                "lib/ash/resource/validation/confirm.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
                }
              ],
              "repo": "https://github.com/ash-project/ash",
              "vendor": "ash-project",
              "versions": [
                {
                  "lessThan": "3.32.2",
                  "status": "affected",
                  "version": "2.17.20",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
              ],
              "packageName": "ash-project/ash",
              "packageURL": "pkg:github/ash-project/ash",
              "product": "ash",
              "programFiles": [
                "lib/ash/resource/validation/confirm.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
                }
              ],
              "repo": "https://github.com/ash-project/ash",
              "vendor": "ash-project",
              "versions": [
                {
                  "lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
                  "status": "affected",
                  "version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.32.2",
                      "versionStartIncluding": "2.17.20",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Jonatan M\u00e4nnchen / EEF"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Zach Daniel / Ash Project"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Resource.Validation.Confirm\u003c/code\u003e\u0027s atomic implementation (\u003ccode\u003eatomic/2\u003c/code\u003e in \u003ccode\u003elib/ash/resource/validation/confirm.ex\u003c/code\u003e) built the mismatch error with its \u003ccode\u003evalue\u003c/code\u003e set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, \u003ccode\u003evalue\u003c/code\u003e resolves through \u003ccode\u003eatomic_ref/2\u003c/code\u003e to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.20 before 3.32.2.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\n`Ash.Resource.Validation.Confirm`\u0027s atomic implementation (`atomic/2` in `lib/ash/resource/validation/confirm.ex`) built the mismatch error with its `value` set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, `value` resolves through `atomic_ref/2` to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
                }
              ],
              "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-54",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-54 Query System for Information"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-209",
                  "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-01T03:27:58.165Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Ash.Resource.Validation.Confirm leaks a confirmed field\u0027s stored value in the atomic mismatch error"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-82739",
        "datePublished": "2026-09-01T03:27:58.165Z",
        "dateReserved": "2026-08-31T00:59:10.002Z",
        "dateUpdated": "2026-09-01T12:44:21.482Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.