CVE-2026-82724— Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
Quick assessment
Affected
ash-project ash_phoenix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： ash_phoenix 中存在“授权不当”（Incorrect Authorization）漏洞，其 SubdomainHook 授权回调在租户（tenant）为 nil 的情况下被调用，导致基于租户范围的访问控制检查无法看到本应强制执行的租户信息。 详细技术说明： 在 中挂载了一个 钩子来分配租户（assign tenant），并在同一个 中立即调用了 。然而，租户的赋值操作只有在 LiveView 稍后执行 时才会真正写入，而这发生在 返回之后。因此， 读取到一个未设置的 assi
Possible ATT&CK Techniques 3 AI
T1029 · Scheduled Transfer T1598.002 · Spearphishing Attachment T1598.001 · Spearphishing Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82724
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.
AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_phoenix | 2.1.26 ~ 2.3.25 |
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_phoenix | 9a5ea4d377bc263de321d79574872a3dfc4fb541 ~ b396e1aa5c6bdec39255f19cf938b539e6d28b71 |
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82724
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82724
请登录查看更多情报信息。
Other References for CVE-2026-82724 (4)
-
🔗 EEF-CVE-2026-82724 - OSV related
-
-
-
Same Patch Batch · ash-project · 2026-08-31 · 17 CVEs total
| CVE-2026-77956 | 10.0 CRITICAL | EEx template evaluation of prompt content in AshAi enables remote code execution |
| CVE-2026-77850 | 8.4 HIGH | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
| CVE-2026-82673 | 8.3 HIGH | Path traversal in AshAdmin file uploads via unsanitized client filename |
| CVE-2026-82722 | 8.3 HIGH | AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node D |
| CVE-2026-75757 | 8.3 HIGH | AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a |
| CVE-2026-81315 | 7.4 HIGH | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header |
| CVE-2026-75760 | 7.1 HIGH | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a us |
| CVE-2026-82564 | 7.1 HIGH | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unident |
| CVE-2026-82726 | 6.3 MEDIUM | AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary t |
| CVE-2026-82579 | 6.0 MEDIUM | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of |
| CVE-2026-82580 | 5.3 MEDIUM | AshAi echoes raw tool exception messages into the conversation, disclosing internal detail |
| CVE-2026-82725 | 2.3 LOW | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private |
| CVE-2026-82727 | 2.3 LOW | AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message |
| CVE-2026-81853 | 2.3 LOW | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attrib |
| CVE-2026-81852 | 2.1 LOW | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
| CVE-2026-82681 | 2.0 LOW | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
IV. Related Vulnerabilities
Same vendor: ash-project
-
CVE-2026-82725
AshPhoenix FilterForm allows filtering across non-public rel -
CVE-2026-82726
AshPhoenix get_subdomain maps a crafted or differently-cased -
CVE-2026-82727
AshPhoenix Form.Auto leaks submitted params in an unknown _u -
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi
Same weakness: CWE-863
-
CVE-2026-80223
Cross-tenant subscription disclosure in AshGraphql authorize -
CVE-2026-81643
Broken access control in AshGraphql subscription batcher app -
CVE-2026-82634
Frappe Framework Development Branch Incorrect Authorization -
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i
V. Comments for CVE-2026-82724
No comments yet