CVE-2026-82725

Name of the Vulnerable Software and Affected Versions ash phoenix versions 0.6.0-rc.1 through 2.3.24

Description An authorization bypass exists in the AshPhoenix.FilterForm component where an attacker controlling filter form parameters can filter across relationships marked as non-public. This allows the returned rows to act as a boolean oracle, revealing private related data. The issue occurs because the system resolved relationship hops using Ash.Resource.Info.related/2, which traverses private relationships, and only verified the publicity of the terminal field. Additionally, the parse path and field/2 function rewrote fields naming a relationship into extra path segments, allowing private relationships to be accepted. These inputs were passed to Ash.Query.do filter/2 without the public-only enforcement typically provided by Ash.Filter.parse input/2.

Recommendations Update ash phoenix to version 2.3.25 or later.