CVE-2026-82724: AshPhoenix SubdomainHook Access Control Vulnerability
Summary
CVE-2026-82724: Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain. Affects ash_phoenix across 2 version ranges.
>= 2.1.26, < 2.3.25
>= 9a5ea4d377bc263de321d79574872a3dfc4fb541, < b396e1aa5c6bdec39255f19cf938b539e6d28b71
Fixed in 2.3.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshPhoenix is a framework that integrates the Ash framework with Phoenix LiveView, allowing developers to build interactive web applications. It provides features for managing subdomains and tenant-scoped access control, which is crucial for multi-tenant applications. This vulnerability arises from improper handling of tenant assignments during the authorization process, potentially allowing unauthorized access.
Vulnerability Detail
The vulnerability stems from a broken access control mechanism in the AshPhoenix SubdomainHook. When the handle_subdomain function is invoked, it is called with a nil tenant due to the order of operations in the on_mount lifecycle. This means that tenant-scoped access checks do not enforce the intended restrictions, leading to potential unauthorized access. The issue affects versions of ash_phoenix from 2.1.26 to before 2.3.25.
How To Fix
Latest published version: 2.3.25 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the handle_subdomain function is not called until after the tenant has been properly assigned in the handle_params hook. This may involve restructuring your code to delay the invocation of handle_subdomain until after the tenant is confirmed.
Conclusion
CVE-2026-82724 presents a significant risk to applications using the AshPhoenix framework due to improper access control mechanisms. It is crucial for developers to update to the patched version to mitigate this vulnerability and ensure tenant-scoped access controls are enforced correctly.
See every vulnerability recorded for ash_phoenix →
FAQ
CVE-2026-82724 is a vulnerability in the AshPhoenix framework that allows unauthorized access due to improper tenant assignment during the authorization process.
Versions of ash_phoenix from 2.1.26 to before 2.3.25 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
If an immediate update is not possible, consider implementing a workaround by restructuring your code to ensure that tenant assignments are handled correctly before invoking the handle_subdomain function.
Related vulnerabilities
Recent vulnerabilities recorded for ash_phoenix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
