CVE-2026-82727: AshPhoenix Form.Auto Sensitive Data Leakage in Error Messages
Summary
CVE-2026-82727: AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message. Affects ash_phoenix across 2 version ranges.
>= 1.2.17, < 2.3.25
>= a3436fcc321e3b34c242cceaf62c3c92bc1a452b, < 0c1775c3cf8988f9abd10a8f92315afc5f06f16d
Fixed in 2.3.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPhoenix is a web framework built on top of the Elixir programming language, designed to facilitate the development of APIs and web applications. It provides a robust set of tools for building forms, handling data, and managing user interactions. However, a vulnerability has been identified in AshPhoenix.Form.Auto, where sensitive information can be leaked through error messages generated during form submissions.
Vulnerability Detail
The vulnerability arises from the way AshPhoenix.Form.Auto constructs error messages when a submitted union type does not match the expected configuration. Specifically, the library embeds the entire raw submitted parameter map into the exception message, which can include sensitive information such as passwords. This information is logged and displayed on the developer error page, making it accessible to unauthorized users. The issue affects versions of ash_phoenix from 1.2.17 to 2.3.25, allowing attackers to exploit this flaw by submitting crafted requests that trigger the error handling mechanism.
How To Fix
Latest published version: 2.3.25 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement custom error handling in your application to filter out sensitive information from error messages. For example, you can modify the error handling logic to only report the offending union type and valid type names, while omitting the full parameter map. This can be done by overriding the default error handling behavior in your application.
Conclusion
CVE-2026-82727 is a significant vulnerability in the AshPhoenix framework that can lead to the exposure of sensitive information through error messages. It is crucial for developers using affected versions to update to the latest version to mitigate this risk. Additionally, implementing custom error handling can provide a temporary solution until an update can be applied.
See every vulnerability recorded for ash_phoenix →
FAQ
CVE-2026-82727 is a vulnerability in the AshPhoenix framework that allows sensitive information to be leaked through error messages when form submissions fail due to incorrect union types.
The vulnerability affects ash_phoenix versions from 1.2.17 to 2.3.25.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2026-82727 is 2.3, indicating a low severity level.
If you cannot update immediately, consider implementing custom error handling to prevent sensitive data from being exposed in error messages as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ash_phoenix.
