AshAdmin CVE-2026-82681

Three concurrent conditions are required for exploitation. First, the targeted Ash resource must use a string primary key - slug, email, or any other user-settable string field - rather than an auto-increment integer; integer-keyed resources are entirely unexploitable. Second, the attacker must have write access sufficient to create or modify a record with a crafted primary key value containing query-string metacharacters (&, #, or =); this could be a registered user setting their own profile slug, a content author choosing a post slug, or any other user-facing string identifier. Third, an AshAdmin operator must actively click a row-action link on the affected record in the Table, DataTable, or Show component (CVSS UI:A), as the attack depends on administrator interaction with the prepared record. Limiting factors: integer primary keys provide complete protection without any configuration change; the attacker cannot directly trigger the unintended action and must rely on an administrator clicking the crafted link; and the impact is limited to misdirected admin actions rather than direct data exfiltration or code execution.

The CVSS 4.0 score of 2.0 with vector AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects the constrained real-world impact: no confidentiality impact, low integrity impact limited to action misdirection, and two hard prerequisites - a crafted string primary key already persisted in the database (AT:P) and an active administrator click (UI:A). No EPSS score is available in the provided data. There is no CISA KEV listing and no public exploit code has been identified at time of analysis. Despite the low numeric score, the operational risk in multi-tenant or externally-writable Ash deployments is non-trivial: a crafted primary key silently converts an admin's 'Edit' click into a 'Destroy' action without any additional confirmation depending on the Ash action configuration, potentially enabling unauthorized record deletion through the admin interface. Environments using integer auto-increment primary keys are entirely unaffected. The input 'RCE' tag is unsupported by any available data - the CVSS vector (VI:L, VC:N), CWE-116, and the vulnerability description all confirm a parameter injection with no code execution pathway.

An attacker with write access to a content or user resource that uses a string primary key creates a record whose key value is legitimate-slug&action_type=destroy. When an AshAdmin operator subsequently views the resource data table and clicks the 'Edit' row-action link for that record, the injected action_type=destroy parameter - resolved last by Plug.Conn.Query - overrides the intended action_type=update, silently presenting the administrator with the destroy confirmation form instead of the edit form. No public exploit code has been identified; the attack requires only knowledge of the AshAdmin URL structure and write access to a string-keyed Ash resource.