CVE-2026-82724

Name of the Vulnerable Software and Affected Versions ash phoenix versions 2.1.26 through 2.3.24

Description An incorrect authorization issue exists where the SubdomainHook authorization callback is invoked with a nil tenant, preventing tenant-scoped access checks from enforcing the intended restrictions. This occurs because AshPhoenix.LiveView.SubdomainHook.on mount/4 attaches a handle params hook to assign the tenant but immediately calls handle subdomain within the same on mount process. Since the tenant assignment only occurs after on mount returns, handle subdomain reads an unset assign. Consequently, a consumer gate designed to halt when a user does not belong to a tenant may evaluate as nil, leading to a system crash or the execution of a permissive branch. This check is not re-run after the actual subdomain is assigned or during subsequent navigations.

Recommendations Update ash phoenix to version 2.3.25 or later.