{"answers":{"affected":"1 open source package ship an affected version, including ash_phoenix.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82724 exists.","fix":"Upgrade ash_phoenix to 2.3.25 or later.","what":"CVE-2026-82724 is a high-severity missing authorization vulnerability in ash-project ash_phoenix, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-82724 and fix it if it is affected.\n\nWhat it is: CVE-2026-82724 is a high-severity missing authorization vulnerability in ash-project ash_phoenix, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82724 exists.\n\nAffected packages and fixed versions:\n- ash_phoenix (Hex): affected from 2.1.26; fixed in 2.3.25\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-82724/ (Markdown: https://insights.sbomify.com/CVE-2026-82724/index.md)","id":"CVE-2026-82724","markdown":"https://insights.sbomify.com/CVE-2026-82724/index.md","name":"CVE-2026-82724","record":{"aliases":["EEF-CVE-2026-82724","GHSA-39c8-xcwr-gqff"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Elixir Phoenix library","requires_auth":"low_privilege","summary":"Attackers can bypass tenant-scoped access controls in AshPhoenix SubdomainHook due to a nil tenant assignment during mount, potentially accessing unauthorized data.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":7.6,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain","id":"CVE-2026-82724","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data","id":"CVE-2026-82725"},"packages":[{"ecosystem":"Hex","fixed":["2.3.25"],"introduced":["2.1.26"],"last_affected":[],"package":"ash_phoenix","purl":"pkg:hex/ash_phoenix","source":"EEF-CVE-2026-82724"}],"prev":{"headline":"Actor record with password digest stored in AshAuthentication audit log entries","id":"CVE-2026-82723"},"products":["ash_phoenix"],"published":"2026-08-31","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-31","vendors":["ash-project"]},"summary":"Attackers can bypass tenant-scoped access controls in AshPhoenix SubdomainHook due to a nil tenant assignment during mount, potentially accessing unauthorized data.","url":"https://insights.sbomify.com/CVE-2026-82724/"}