EUVD-2026-68336Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires the specific deployment condition of SubdomainHook with tenant auth callbacks; S:C because the impact crosses tenant security boundaries; PR:L per CVSS 4.0 input confirming authenticated access required.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.
AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
AnalysisAI
Tenant authorization bypass in ash_phoenix's SubdomainHook allows an authenticated user to cross tenant boundaries and access or modify data belonging to other tenants. The flaw is rooted in a LiveView lifecycle ordering error: AshPhoenix.LiveView.SubdomainHook.on_mount/4 called the consumer-defined authorization callback before Phoenix LiveView's handle_params phase had run, guaranteeing the callback always received a nil tenant and either crashed or silently permitted the request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) the target application uses ash_phoenix 2.1.26 through 2.3.24 with AshPhoenix.LiveView.SubdomainHook attached in on_mount; (2) the application has implemented a consumer SubdomainHook authorization callback that enforces tenant-scoped access checks (applications that use SubdomainHook only for tenant assignment without an authorization gate are not exposed to the authorization bypass, though they may experience nil-related crashes); (3) the attacker holds a valid authenticated session to reach the protected LiveView endpoint, consistent with PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N reflects a network-exploitable flaw moderated by AT:P - the specific precondition that the application deploys SubdomainHook with tenant-scoped authorization callbacks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_phoenix to version 2.3.25 or later, which restructures SubdomainHook so that both tenant assignment and the handle_subdomain authorization callback run inside handle_params on every navigation, ensuring the real tenant is always present when authorization is evaluated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Phoenix
View allTenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote
Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix ve
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today