CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
Attackers can filter across private relationships to disclose sensitive data via boolean oracle attacks in AshPhoenix FilterForm.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82725?
CVE-2026-82725 is a low-severity missing authorization vulnerability in ash-project ash_phoenix, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.
AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.
This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.
Weakness: CWE-639
Which versions are affected by CVE-2026-82725?
1 open source package ship an affected version, including ash_phoenix.
| Package | Affected | Fixed in |
|---|---|---|
ash_phoenix Hex | From 0.6.0-rc.1 | 2.3.25 |
How do I fix CVE-2026-82725?
Upgrade ash_phoenix to 2.3.25 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-82725 being exploited?
There is no known exploitation of CVE-2026-82725 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-82725, GHSA-7xhg-xphm-f458.