EUVD-2026-68327Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs low privileges to set a crafted primary key; admin click required (UI:R); integrity-only impact from action misdirection with no confidentiality or availability effect.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links.
The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a
truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.
This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.
AnalysisAI
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolation, splicing unencoded record primary keys directly into query strings. Attackers who control a record's string primary key - common in Ash applications using slugs or email addresses as identifiers - can craft a key containing query-string metacharacters (e.g., legitimate-slug&action_type=destroy) that override URL parameters when an administrator clicks a row-action link, silently redirecting them to an unintended action such as resource destruction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.0 with vector AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects the constrained real-world impact: no confidentiality impact, low integrity impact limited to action misdirection, and two hard prerequisites - a crafted string primary key already persisted in the database (AT:P) and an active administrator click (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_admin to version 1.3.1 or later, which is the vendor-released patch confirmed by the advisory GHSA-j89q-xjrh-c26p at https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p and the fix commit at https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enablin
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdo
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin in
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and st
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allShare
External POC / Exploit Code
Leaving vuln.today