{"id":"CVE-2026-82724","aliases":["EEF-CVE-2026-82724","EUVD-2026-68336","GHSA-39c8-xcwr-gqff"],"status":"published","title":"Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain","description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","severity":{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00427,"percentile":0.37468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-31T03:07:57Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Hex","package":"ash_phoenix","fixed_in":["2.3.25"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_phoenix","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.26"},{"fixed":"2.3.25"}]}],"versions":["2.1.26","2.2.0","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.19","2.3.2","2.3.20","2.3.21","2.3.22","2.3.23","2.3.24","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"]}],"products":[{"vendor":"ash-project","product":"ash_phoenix"}],"references":[{"url":"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-82724.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-82724","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_phoenix/commit/b396e1aa5c6bdec39255f19cf938b539e6d28b71","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82724.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82724","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_phoenix","tags":["package"]},{"url":"https://hex.pm/packages/ash_phoenix","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-82724","title":"Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain","description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","status":"published","published":"2026-08-31T03:07:57.455Z","modified":"2026-08-31T15:54:49.058Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-68336","description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","status":"published","published":"2026-08-31T03:07:57Z","modified":"2026-08-31T15:54:49Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:20.704822Z"}],"nvd":[{"id":"CVE-2026-82724","description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","status":"published","published":"2026-08-31T04:17:28.98Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-82724","title":"Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain","description":"Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.","status":"published","published":"2026-08-31T03:07:57.455Z","modified":"2026-10-28T02:30:22.659279392Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"EEF-CVE-2026-82724","title":"Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain","description":"## Summary\n\nIncorrect Authorization vulnerability in ash-project ash_phoenix invokes the `SubdomainHook` authorization callback with a `nil` tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\n`AshPhoenix.LiveView.SubdomainHook.on_mount/4` attached a `handle_params` hook to assign the tenant and then immediately called `handle_subdomain` in the same `on_mount`. The tenant assign is only written when LiveView later runs `handle_params`, strictly after `on_mount` returns, so `handle_subdomain` read an unset assign and ran as `apply(m, f, [socket, nil | a])`. A consumer gate that halts when the user does not belong to the tenant instead evaluated `nil`, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs `handle_subdomain` inside the `handle_params` hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.\n\n## Configurations\n\nThe application uses `AshPhoenix.LiveView.SubdomainHook` with a `handle_subdomain` callback as a tenant-scoped authorization gate.","status":"published","published":"2026-08-31T03:07:57.455Z","modified":"2026-09-08T03:45:09.966070734Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}