Current section

4 Advisories

Jump to
EEF-CVE-2026-82725 CVE-2026-82725 GHSA-7xhg-xphm-f458

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

August 31, 2026
CVSS
?
2.3 / 10.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.6.0-rc.1 and < 2.3.25
EEF-CVE-2026-82724 CVE-2026-82724 GHSA-39c8-xcwr-gqff

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

August 31, 2026
CVSS
?
7.6 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 2.1.26 and < 2.3.25
EEF-CVE-2026-82726 CVE-2026-82726 GHSA-rpf8-q9jh-qxrr

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

August 31, 2026
CVSS
?
6.3 / 10.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Versions

>= 2.1.26 and < 2.3.25
EEF-CVE-2026-82727 CVE-2026-82727 GHSA-5xf4-hgcq-xw7v

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

August 31, 2026
CVSS
?
2.3 / 10.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 1.2.17 and < 2.3.25

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 1K 2K 3K 4K

this version

0

yesterday

1 637

last 7 days

21 735

all time

1 170 696

Last Updated

Aug 31, 2026

License

MIT

Build Tools

mix

Publisher

ash-project ash-project