CVE-2026-81853: AshAdmin Composite Primary Key Decoding Vulnerability Leading to Authorization Bypass
Summary
CVE-2026-81853: AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle. Affects ash_admin across 2 version ranges.
>= 0.1.0, < 1.3.1
>= 98b03baa8422b94dd13e305bf08b8ee3f7232c7b, < 3c3e905d47f1155dcc1ca3fb347348b05a66065a
Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAdmin is a component of the Ash framework designed for building APIs in Elixir. It provides a user-friendly interface for managing resources and permissions. The framework supports composite primary keys, allowing for more complex data structures. However, this flexibility introduces vulnerabilities, particularly in how it handles key decoding, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the AshAdmin package, specifically in the decode_primary_key function. This function decodes composite primary keys without validating that the keys belong to the resource's primary-key fields. As a result, an attacker can manipulate the lookup filter by injecting arbitrary fields, allowing them to brute-force sensitive attribute values such as API tokens. The lack of restrictions on decoded keys enables this exploitation, posing a significant risk to data integrity and confidentiality.
How To Fix
Latest published version: 1.3.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not expose sensitive attributes through AshAdmin until the package is updated. Implement additional authorization checks to restrict access to sensitive data.
Conclusion
CVE-2026-81853 presents a significant risk to applications using the AshAdmin package due to its flawed handling of composite primary key decoding. It is crucial to update to the patched version to mitigate this vulnerability and protect sensitive data from unauthorized access.
See every vulnerability recorded for ash_admin →
FAQ
CVE-2026-81853 is a vulnerability in the AshAdmin package that allows unauthorized access to sensitive attributes through a composite primary key decoding flaw.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The vulnerability can lead to unauthorized access to sensitive data, such as API tokens, which can compromise the security of your application.
If an immediate update is not possible, implement additional authorization checks and restrict access to sensitive attributes until the package is updated.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_admin.
