EUVD-2026-68405

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-82870 ToolJet before v3.16.208 Cross-Tenant Database Manipulation

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-82870

ToolJet before v3.16.208 contains a cross-tenant database manipulation vulnerability caused by missing organization-resolving guards in its database write and destroy routes. Any user with a builder-role can bypass organizationId ownership validation, allowing them to create, alter, or permanentl...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82724

Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the...

CVE-2026-82724

Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the...

EUVD-2026-68336

Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the...

CVE-2026-82724

AshPhoenix.LiveView.SubdomainHook in the ash-project/ash_phoenix Elixir library (versions 2.1.26 through before 2.3.25) contains a broken access control flaw. The handle_subdomain authorization callback was invoked during on_mount/4 , before the tenant assign was written by the handle_params hook...

CVE-2026-82724 Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the...

CVE-2026-82724 Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the...

EEF-CVE-2026-82724 Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

Summary Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to...

EUVD-2026-68335

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726

CVE-2026-82726 is a permissive regular expression vulnerability in ash-project ash_phoenix (versions 2.1.26 through before 2.3.25). The function AshPhoenix.Helpers.get_subdomain/2 interpolated the root host raw into a regex, turning each dot into a wildcard and allowing metacharacters as pattern ...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

EEF-CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Summary Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

PT-2026-83688

Incorrect Authorization vulnerability in ash-project ash phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. AshPhoenix.LiveView.SubdomainHook.on mount/4 attached a handle params hook to assign...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...