#575 - chore(deps): update dependency ash_phoenix to v2.3.25 [security] - autoclosed - local-it/mitgliederverwaltung

renovate commented

2026-10-08 14:22:58 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
ash_phoenix (source)	prod	patch	`2.3.22` → `2.3.25`

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

CVE-2026-82724 / EEF-CVE-2026-82724 / GHSA-39c8-xcwr-gqff

More information

Details

Summary

Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.

AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.

This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

Configurations

The application uses AshPhoenix.LiveView.SubdomainHook with a handle_subdomain callback as a tenant-scoped authorization gate.

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

CVE-2026-82725 / EEF-CVE-2026-82725 / GHSA-7xhg-xphm-f458

More information

Details

Summary

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.

AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.

This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.

Configurations

The resource exposes an AshPhoenix.FilterForm whose params the attacker controls, and has a non-public relationship to data that should not be filterable.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

CVE-2026-82726 / EEF-CVE-2026-82726 / GHSA-rpf8-q9jh-qxrr

More information

Details

Summary

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.

AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.

This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

Configurations

The application uses subdomain-based multitenancy via AshPhoenix.Helpers.get_subdomain/2 (for example through AshPhoenix.LiveView.SubdomainHook) to select the tenant from the request host.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV.

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

CVE-2026-82727 / EEF-CVE-2026-82727 / GHSA-5xf4-hgcq-xw7v

More information

Details

Summary

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.

When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.

This issue affects ash_phoenix: from 1.2.17 before 2.3.25.

Configurations

The application renders an AshPhoenix.Form with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Release Notes

ash-project/ash_phoenix (ash_phoenix)

`v2.3.25`

Compare Source

Bug Fixes:

remove deprecated page_from_params/3 (client-controlled count) by @zachdaniel
don't leak submitted params in unknown _union_type error (CVE-2026-82727) by @zachdaniel
match root host case-insensitively and as an exact suffix in get_subdomain (CVE-2026-82726) by @zachdaniel
reject filtering across non-public relationships in FilterForm (CVE-2026-82725) by @zachdaniel
run handle_subdomain with the real tenant in handle_params (cross-tenant) (CVE-2026-82724) by @zachdaniel
propagate actor, scope and tenant to a single nested form built from existing data (#483) by Johannes Welebil (#483)
don't use negated? for filter generation by @zachdaniel
prevent false PendingCodegen when the check races the code reloader (#482) by @Malian (#482)
resolve actor and tenant from scope before building nested forms (#480) by @Valian (#480)

`v2.3.24`

Compare Source

Bug Fixes:

Rename Ash.Resource.record() -> Ash.Resource.Record.t() by @jimsynz

`v2.3.23`

Compare Source

Bug Fixes:

unwrap NewType in auto-form map_type? check (#475) by sevenseacat (#475)
Skip embed form standalone validation (#474) by sevenseacat (#474)
propagate shared context to nested forms in add_form and validate (#472) by @nallwhy (#472)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ash_phoenix](https://hex.pm/packages/ash_phoenix) ([source](https://github.com/ash-project/ash_phoenix)) | prod | patch | `2.3.22` → `2.3.25` | --- ### Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain [CVE-2026-82724](https://nvd.nist.gov/vuln/detail/CVE-2026-82724) / EEF-CVE-2026-82724 / [GHSA-39c8-xcwr-gqff](https://github.com/advisories/GHSA-39c8-xcwr-gqff) <details> <summary>More information</summary> #### Details ##### Summary Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the `SubdomainHook` authorization callback with a `nil` tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. `AshPhoenix.LiveView.SubdomainHook.on_mount/4` attached a `handle_params` hook to assign the tenant and then immediately called `handle_subdomain` in the same `on_mount`. The tenant assign is only written when LiveView later runs `handle_params`, strictly after `on_mount` returns, so `handle_subdomain` read an unset assign and ran as `apply(m, f, [socket, nil | a])`. A consumer gate that halts when the user does not belong to the tenant instead evaluated `nil`, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs `handle_subdomain` inside the `handle_params` hook with the real tenant on every navigation. This issue affects ash_phoenix: from 2.1.26 before 2.3.25. ##### Configurations The application uses `AshPhoenix.LiveView.SubdomainHook` with a `handle_subdomain` callback as a tenant-scoped authorization gate. #### Severity - CVSS Score: 7.6 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff](https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff) - [https://cna.erlef.org/cves/CVE-2026-82724.html](https://cna.erlef.org/cves/CVE-2026-82724.html) - [https://github.com/ash-project/ash_phoenix/commit/b396e1aa5c6bdec39255f19cf938b539e6d28b71](https://github.com/ash-project/ash_phoenix/commit/b396e1aa5c6bdec39255f19cf938b539e6d28b71) - [https://hex.pm/packages/ash_phoenix](https://hex.pm/packages/ash_phoenix) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82724). </details> --- ### AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data [CVE-2026-82725](https://nvd.nist.gov/vuln/detail/CVE-2026-82725) / EEF-CVE-2026-82725 / [GHSA-7xhg-xphm-f458](https://github.com/advisories/GHSA-7xhg-xphm-f458) <details> <summary>More information</summary> #### Details ##### Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data. `AshPhoenix.FilterForm` resolved every relationship hop in the user-supplied `path` with `Ash.Resource.Info.related/2`, which traverses private relationships, and only checked the terminal field for publicity. `parse_path_and_field/2` also rewrote a `field` naming a relationship into an extra path segment, so `field=some_private_rel` was accepted too. Both `path` and `field` come straight from form params, and the resulting ref went to `Ash.Query.do_filter/2` without the public-only enforcement of `Ash.Filter.parse_input/2`. The fix resolves each hop with `Ash.Resource.Info.public_relationship/2`, rejecting the first non-public hop, and requires the terminal field to be public. This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25. ##### Configurations The resource exposes an `AshPhoenix.FilterForm` whose params the attacker controls, and has a non-public relationship to data that should not be filterable. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458](https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458) - [https://cna.erlef.org/cves/CVE-2026-82725.html](https://cna.erlef.org/cves/CVE-2026-82725.html) - [https://github.com/ash-project/ash_phoenix/commit/a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b](https://github.com/ash-project/ash_phoenix/commit/a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b) - [https://hex.pm/packages/ash_phoenix](https://hex.pm/packages/ash_phoenix) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82725). </details> --- ### AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant [CVE-2026-82726](https://nvd.nist.gov/vuln/detail/CVE-2026-82726) / EEF-CVE-2026-82726 / [GHSA-rpf8-q9jh-qxrr](https://github.com/advisories/GHSA-rpf8-q9jh-qxrr) <details> <summary>More information</summary> #### Details ##### Summary Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted `Host` header. `AshPhoenix.Helpers.get_subdomain/2` stripped the root domain with `String.replace(host, ~r/.?#{root_host}/, "")`. The root host was interpolated raw, so each `.` became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With `root_host` `example.com`, `Host: foo.exampleXcom.attacker.net` returned the tenant `foo.attacker.net`. A metacharacter-bearing or `nil` root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so `TENANT.EXAMPLE.COM` and `EXAMPLE.COM` slipped past the root-host allowlist. `conn.host` comes from the client `Host` header. The fix matches the root host case-insensitively and only as an exact trailing suffix. This issue affects ash_phoenix: from 2.1.26 before 2.3.25. ##### Configurations The application uses subdomain-based multitenancy via `AshPhoenix.Helpers.get_subdomain/2` (for example through `AshPhoenix.LiveView.SubdomainHook`) to select the tenant from the request host. #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr](https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr) - [https://cna.erlef.org/cves/CVE-2026-82726.html](https://cna.erlef.org/cves/CVE-2026-82726.html) - [https://github.com/ash-project/ash_phoenix/commit/8306f29e77526840c89f3cd244996ce7c0fa2cda](https://github.com/ash-project/ash_phoenix/commit/8306f29e77526840c89f3cd244996ce7c0fa2cda) - [https://hex.pm/packages/ash_phoenix](https://hex.pm/packages/ash_phoenix) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82726). </details> --- ### AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message [CVE-2026-82727](https://nvd.nist.gov/vuln/detail/CVE-2026-82727) / EEF-CVE-2026-82727 / [GHSA-5xf4-hgcq-xw7v](https://github.com/advisories/GHSA-5xf4-hgcq-xw7v) <details> <summary>More information</summary> #### Details ##### Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix's parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{"_union_type" => "nope", "password" => "..."}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps. This issue affects ash_phoenix: from 1.2.17 before 2.3.25. ##### Configurations The application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v](https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v) - [https://cna.erlef.org/cves/CVE-2026-82727.html](https://cna.erlef.org/cves/CVE-2026-82727.html) - [https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d](https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d) - [https://hex.pm/packages/ash_phoenix](https://hex.pm/packages/ash_phoenix) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82727). </details> --- ### Release Notes <details> <summary>ash-project/ash_phoenix (ash_phoenix)</summary> ### [`v2.3.25`](https://github.com/ash-project/ash_phoenix/blob/HEAD/CHANGELOG.md#v2325-2026-08-31) [Compare Source](https://github.com/ash-project/ash_phoenix/compare/v2.3.24...v2.3.25) ##### Bug Fixes: - remove deprecated page\_from\_params/3 (client-controlled count) by [@zachdaniel](https://github.com/zachdaniel) - don't leak submitted params in unknown \_union\_type error (CVE-2026-82727) by [@zachdaniel](https://github.com/zachdaniel) - match root host case-insensitively and as an exact suffix in get\_subdomain (CVE-2026-82726) by [@zachdaniel](https://github.com/zachdaniel) - reject filtering across non-public relationships in FilterForm (CVE-2026-82725) by [@zachdaniel](https://github.com/zachdaniel) - run handle\_subdomain with the real tenant in handle\_params (cross-tenant) (CVE-2026-82724) by [@zachdaniel](https://github.com/zachdaniel) - propagate actor, scope and tenant to a single nested form built from existing data ([#483](https://github.com/ash-project/ash_phoenix/issues/483)) by Johannes Welebil [(#483)](https://github.com/ash-project/ash_phoenix/pull/483) - don't use `negated?` for filter generation by [@zachdaniel](https://github.com/zachdaniel) - prevent false PendingCodegen when the check races the code reloader ([#482](https://github.com/ash-project/ash_phoenix/issues/482)) by [@Malian](https://github.com/Malian) [(#482)](https://github.com/ash-project/ash_phoenix/pull/482) - resolve actor and tenant from scope before building nested forms ([#480](https://github.com/ash-project/ash_phoenix/issues/480)) by [@Valian](https://github.com/Valian) [(#480)](https://github.com/ash-project/ash_phoenix/pull/480) ### [`v2.3.24`](https://github.com/ash-project/ash_phoenix/blob/HEAD/CHANGELOG.md#v2324-2026-07-08) [Compare Source](https://github.com/ash-project/ash_phoenix/compare/v2.3.23...v2.3.24) ##### Bug Fixes: - Rename Ash.Resource.record() -> Ash.Resource.Record.t() by [@jimsynz](https://github.com/jimsynz) ### [`v2.3.23`](https://github.com/ash-project/ash_phoenix/blob/HEAD/CHANGELOG.md#v2323-2026-06-05) [Compare Source](https://github.com/ash-project/ash_phoenix/compare/v2.3.22...v2.3.23) ##### Bug Fixes: - unwrap `NewType` in auto-form `map_type?` check ([#475](https://github.com/ash-project/ash_phoenix/issues/475)) by sevenseacat [(#475)](https://github.com/ash-project/ash_phoenix/pull/475) - Skip embed form standalone validation ([#474](https://github.com/ash-project/ash_phoenix/issues/474)) by sevenseacat [(#474)](https://github.com/ash-project/ash_phoenix/pull/474) - propagate shared context to nested forms in add\_form and validate ([#472](https://github.com/ash-project/ash_phoenix/issues/472)) by [@nallwhy](https://github.com/nallwhy) [(#472)](https://github.com/ash-project/ash_phoenix/pull/472) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

security

label

2026-10-08 14:22:58 +02:00

renovate added 1 commit

2026-10-08 14:22:58 +02:00

chore(deps): update dependency ash_phoenix to v2.3.25 [security]

continuous-integration/drone/push Build is failing

Details

ea649a3b0d

renovate force-pushed renovate/hex-ash_phoenix-vulnerability from ea649a3b0d

continuous-integration/drone/push Build is failing

Details

to c398297cce

continuous-integration/drone/push Build is failing

Details

2026-10-08 21:23:22 +02:00

Compare

renovate force-pushed renovate/hex-ash_phoenix-vulnerability from c398297cce

continuous-integration/drone/push Build is failing

Details

to 29512c9f39

continuous-integration/drone/push Build is passing

Details

2026-10-10 02:02:50 +02:00

Compare

renovate force-pushed renovate/hex-ash_phoenix-vulnerability from 29512c9f39

continuous-integration/drone/push Build is passing

Details

to 32398b265a

continuous-integration/drone/push Build is passing

Details

2026-10-11 02:03:16 +02:00

Compare

renovate force-pushed renovate/hex-ash_phoenix-vulnerability from 32398b265a

continuous-integration/drone/push Build is passing

Details

to ae8dd0ba5c

continuous-integration/drone/push Build is passing

Details

2026-10-12 02:02:56 +02:00

Compare

renovate changed title from ~~chore(deps): update dependency ash_phoenix to v2.3.25 [security]~~ to chore(deps): update dependency ash_phoenix to v2.3.25 [security] - autoclosed

2026-10-12 12:14:41 +02:00

renovate closed this pull request

2026-10-12 12:14:41 +02:00

continuous-integration/drone/push Build is passing

Details

continuous-integration/drone/promote/production

Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Rows
Columns

chore(deps): update dependency ash_phoenix to v2.3.25 [security] - autoclosed #575

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

Details

Summary

Configurations

Severity

References

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Details

Summary

Configurations

Severity

References

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Details

Summary

Configurations

Severity

References

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Details

Summary

Configurations

Severity

References

Release Notes

v2.3.25

Bug Fixes:

v2.3.24

Bug Fixes:

v2.3.23

Bug Fixes:

Configuration

Pull request closed

`v2.3.25`

`v2.3.24`

`v2.3.23`