CVE-2026-81853

Name of the Vulnerable Software and Affected Versions ash admin versions 0.1.0 through 1.3.0

Description An authorization bypass exists where a record-lookup URL can be used as an equality oracle over sensitive attributes. The decode primary key/2 function decodes the composite-primary-key form using Base64 and External Term Format (ETF) and returns the decoded map as a lookup filter without verifying if the keys are actual primary-key fields. Although deserialization guards limit size and block new atoms, functions, and nested expressions, they do not restrict which fields are returned. An attacker can encode a map, such as %{api token: "guess"}, to be spliced into the lookup filter, allowing them to brute-force sensitive attribute values like API tokens or reset tokens. Additionally, Map.to list/1 accepts structs, which can result in a bogus struct key.

Recommendations Update ash admin to version 1.3.1 or later.