CVE-2026-81853 (GCVE-0-2026-81853)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:31 – Updated: 2026-08-31 15:58
VLAI
EPSS
VEX
Title
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:57 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81853 | related |
| https://github.com/ash-project/ash_admin/commit/3… | patch |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
||
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 3c3e905d47f1155dcc1ca3fb347348b05a66065a
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81853",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:57:41.689629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:58:40.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Helpers.decode_primary_key/2\u003c/code\u003e decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and \u003ccode\u003e:safe\u003c/code\u003e still allows any already-interned attribute name. An attacker can therefore encode \u003ccode\u003e%{api_token: \"guess\"}\u003c/code\u003e and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; \u003ccode\u003eMap.to_list/1\u003c/code\u003e also accepts structs, yielding a bogus \u003ccode\u003e__struct__\u003c/code\u003e key. The fix rejects any decoded key that is not a real primary-key field.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\n`AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: \"guess\"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:31:29.547Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81853",
"datePublished": "2026-08-31T02:31:29.547Z",
"dateReserved": "2026-08-30T23:15:02.371Z",
"dateUpdated": "2026-08-31T15:58:40.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-81853",
"date": "2026-10-15",
"epss": "0.00449",
"percentile": "0.37505"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"id": "CVE-2026-81853",
"lastModified": "2026-09-01T21:15:00.147",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-81853",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:57:41.689629Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-31T03:16:42.670",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81853",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:57:41.689629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:58:03.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Helpers.decode_primary_key/2\u003c/code\u003e decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and \u003ccode\u003e:safe\u003c/code\u003e still allows any already-interned attribute name. An attacker can therefore encode \u003ccode\u003e%{api_token: \"guess\"}\u003c/code\u003e and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; \u003ccode\u003eMap.to_list/1\u003c/code\u003e also accepts structs, yielding a bogus \u003ccode\u003e__struct__\u003c/code\u003e key. The fix rejects any decoded key that is not a real primary-key field.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\n`AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: \"guess\"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:31:29.547Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81853",
"datePublished": "2026-08-31T02:31:29.547Z",
"dateReserved": "2026-08-30T23:15:02.371Z",
"dateUpdated": "2026-08-31T15:58:40.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.