Skip to content
OpenAdvisories

Package · Hex

ash_admin

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-81853

    AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

    Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF)…

    ash-project ash_admin ash_admin Hex
  • Low 2.1
    CVE-2026-81852

    AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

    Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted…

    ash-project ash_admin ash_admin Hex
  • Low 2.0
    CVE-2026-82681

    Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

    Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by ra…

    ash-project ash_admin ash_admin Hex