Riskcovery

CVE-2026-82725

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

State
Published
Severity
2.3 Low
Published
Aug 31, 2026
Updated
Aug 31, 2026
Reserved
Aug 31, 2026

Read the record on cve.org

Description

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.

AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.

This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
ash_phoenixash-project
  • 0.6.0-rc.1 to before 2.3.25Affected
ash_phoenixash-project
  • 06875682999938f607c970e71b6a80af90e18b3d to before a3691a3cb0947e8f2dc2c3cbff138a3e6197a15bAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.