CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes
Attackers bypass declared argument constraints in AshTypescript routes, potentially escalating privileges or modifying data by submitting invalid values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82732?
CVE-2026-82732 is a medium-severity missing authorization vulnerability in ash-project ash_typescript, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.
AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument.
Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-82732?
1 open source package ship an affected version, including ash_typescript.
| Package | Affected | Fixed in |
|---|---|---|
ash_typescript Hex | From 0.15.0 | 0.18.0 |
How do I fix CVE-2026-82732?
Upgrade ash_typescript to 0.18.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-82732 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82732 exists.
Sources
Also known as EEF-CVE-2026-82732, GHSA-f7fq-hwq6-jhvv.