ash_phoenix CVE-2026-82724

Exploitation requires three specific conditions: (1) the target application uses ash_phoenix 2.1.26 through 2.3.24 with AshPhoenix.LiveView.SubdomainHook attached in on_mount; (2) the application has implemented a consumer SubdomainHook authorization callback that enforces tenant-scoped access checks (applications that use SubdomainHook only for tenant assignment without an authorization gate are not exposed to the authorization bypass, though they may experience nil-related crashes); (3) the attacker holds a valid authenticated session to reach the protected LiveView endpoint, consistent with PR:L in the CVSS 4.0 vector. The key limiting factors are: the Elixir/Ash ecosystem deployment requirement narrows the exposed population; authentication is required, ruling out unauthenticated internet-scale exploitation; and the bypass is only triggered at the LiveView connection and navigation level, not through arbitrary HTTP requests. Applications whose SubdomainHook callback crashes unhandled on nil rather than branching permissively present reduced cross-tenant data access risk, but may still expose error information.

The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N reflects a network-exploitable flaw moderated by AT:P - the specific precondition that the application deploys SubdomainHook with tenant-scoped authorization callbacks. For any application that does meet that condition, however, the bypass is total and systematic: every authenticated user bypasses all tenant isolation checks on initial LiveView connection and retains that bypass for the full session. High confidentiality and integrity impacts (VC:H/VI:H) are well-calibrated given the cross-tenant data read and write potential. EPSS data is absent from the provided intelligence, which limits probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, suggesting opportunistic mass exploitation is not currently occurring. Real-world priority should be governed by whether the application relies on SubdomainHook for compliance-grade tenant isolation - even a mid-sized municipal IT team in swidnica operating a multi-tenant Ash Framework SaaS would be well-advised to treat this as urgent given that the bypass is unconditional once the deployment condition is met, and the fix is a straightforward library upgrade with no breaking API changes.

An authenticated user in a multi-tenant application built on ash_phoenix connects to a LiveView page protected by SubdomainHook. On initial mount, on_mount invokes the tenant authorization callback with a nil tenant; the callback's consumer gate evaluates nil and either crashes with a handled error or takes a permissive branch, granting the session access to resources outside the attacker's assigned tenant. Because the check is not re-run on subsequent in-session navigations, the attacker retains cross-tenant access for the lifetime of the LiveView connection, able to read and modify other tenants' data through the application's normal UI.