{"id":"CVE-2026-82727","aliases":["EEF-CVE-2026-82727","EUVD-2026-68334","GHSA-5xf4-hgcq-xw7v"],"status":"published","title":"AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message","description":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00466,"percentile":0.40823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209"],"published":"2026-08-31T03:03:58Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"Hex","package":"ash_phoenix","fixed_in":["2.3.25"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_phoenix","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.17"},{"fixed":"2.3.25"}]}],"versions":["1.2.17","1.2.18","1.2.19","1.2.20","1.2.21","1.2.22","1.2.23","1.2.24","1.2.25","1.2.26","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","2.0.0","2.0.0-rc.0","2.0.0-rc.1","2.0.0-rc.2","2.0.0-rc.3","2.0.0-rc.4","2.0.0-rc.5","2.0.0-rc.6","2.0.0-rc.7","2.0.0-rc.8","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.20","2.1.21","2.1.22","2.1.23","2.1.24","2.1.25","2.1.26","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.19","2.3.2","2.3.20","2.3.21","2.3.22","2.3.23","2.3.24","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"]}],"products":[{"vendor":"ash-project","product":"ash_phoenix"}],"references":[{"url":"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-82727.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-82727","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82727.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82727","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_phoenix","tags":["package"]},{"url":"https://hex.pm/packages/ash_phoenix","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-82727","title":"AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message","description":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.","status":"published","published":"2026-08-31T03:03:58.982Z","modified":"2026-08-31T14:49:25.154Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-68334","description":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.","status":"published","published":"2026-08-31T03:03:58Z","modified":"2026-08-31T14:49:25Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:01:21.100116Z"}],"nvd":[{"id":"CVE-2026-82727","description":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.","status":"published","published":"2026-08-31T04:17:29.56Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-82727","title":"AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message","description":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.","status":"published","published":"2026-08-31T03:03:58.982Z","modified":"2026-10-28T02:30:42.443757901Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"EEF-CVE-2026-82727","title":"AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message","description":"## Summary\n\nGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix's parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\n\n## Configurations\n\nThe application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.","status":"published","published":"2026-08-31T03:03:58.982Z","modified":"2026-09-08T03:30:11.976510412Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}