ash-project ash_phoenix up to 2.3.24 SubdomainHook AshPhoenix.LiveView.SubdomainHook.on_mount improper authorization

Summaryinfo

A vulnerability described as critical has been identified in ash-project ash_phoenix up to 2.3.24. Affected is the function AshPhoenix.LiveView.SubdomainHook.on_mount of the component SubdomainHook. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-82724. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in ash-project ash_phoenix up to 2.3.24 and classified as critical. Affected by this issue is the function AshPhoenix.LiveView.SubdomainHook.on_mount of the component SubdomainHook. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation. This issue affects ash_phoenix: from 2.1.26 before 2.3.25.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-82724 since 08/31/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 2.3.25 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_phoenix

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.3.13
• 2.3.14
• 2.3.15
• 2.3.16
• 2.3.17
• 2.3.18
• 2.3.19
• 2.3.20
• 2.3.21
• 2.3.22
• 2.3.23
• 2.3.24

Website

• Product: https://github.com/ash-project/ash_phoenix/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion