EEF-CVE-2026-81853 CVE-2026-81853 GHSA-jxr8-hpv2-qp38
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.45%
- Chance of exploitation in the next 30 days. Higher than 39.03% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-639 Authorization Bypass Through User-Controlled Key
- Fix
1.3.1- Upgrade ash_admin to this version or later
Description
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Configurations
The resource has a composite primary key, and the deployment relies on AshAdmin's authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_admin | >= 0.1.0, < 1.3.1 |
1.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_admin Hex → 1.3.1
- mix
{:ash_admin, "~> 1.3.1"} # then: mix deps.update ash_admin
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
How to prevent it
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82722 AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain | Not rated yet | Also affects ash_admin |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass | Medium | Same weakness, CWE-639 |
| EEF-CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | Not rated yet | Same weakness, CWE-639 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor