CVE-2026-82725: AshPhoenix FilterForm Vulnerability Allows Unauthorized Data Access
Summary
CVE-2026-82725: AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data. Affects ash_phoenix across 2 version ranges.
>= 0.6.0-rc.1, < 2.3.25
>= 06875682999938f607c970e71b6a80af90e18b3d, < a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b
Fixed in 2.3.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPhoenix is a web framework built on top of the Ash framework, designed to facilitate the development of APIs and web applications in Elixir. It provides features such as resource management, query building, and form handling. However, a critical vulnerability has been identified in the AshPhoenix.FilterForm component, which allows attackers to exploit non-public relationships, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the AshPhoenix.FilterForm, where user-controlled filter parameters can traverse non-public relationships. This flaw allows an attacker to manipulate the filtering process, effectively turning it into a boolean oracle over private related data. The issue is rooted in the way the framework resolves relationship hops and checks for public access only at the terminal field, neglecting earlier hops. This oversight can lead to unauthorized data exposure, making it crucial for users of affected versions to address the vulnerability promptly.
How To Fix
Latest published version: 2.3.25 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the visibility of relationships before allowing filtering. This may involve customizing the filter logic to ensure that only public relationships are accessible.
Conclusion
The CVE-2026-82725 vulnerability in AshPhoenix poses a significant risk by allowing unauthorized access to private data through manipulated filter parameters. It is essential for users of affected versions to update to the patched version 2.3.25 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect sensitive data until an update can be applied.
See every vulnerability recorded for ash_phoenix →
FAQ
CVE-2026-82725 is a vulnerability in the AshPhoenix framework that allows unauthorized access to private related data through manipulated filter parameters.
The vulnerability affects AshPhoenix versions from 0.6.0-rc.1 up to, but not including, 2.3.25.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 2.3, indicating a low severity level.
If an immediate update is not possible, implement additional validation checks in your application to restrict access to non-public relationships as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for ash_phoenix.
