CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Attackers can brute-force sensitive attributes like API tokens by manipulating composite primary key decoding in AshAdmin, bypassing intended lookup restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81853?
CVE-2026-81853 is a low-severity authentication bypass vulnerability in ash-project ash_admin, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Weakness: CWE-639
Which versions are affected by CVE-2026-81853?
1 open source package ship an affected version, including ash_admin.
| Package | Affected | Fixed in |
|---|---|---|
ash_admin Hex | From 0.1.0 | 1.3.1 |
How do I fix CVE-2026-81853?
Upgrade ash_admin to 1.3.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-81853 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81853 exists.
Sources
Also known as EEF-CVE-2026-81853, GHSA-jxr8-hpv2-qp38.