CVE-2026-82724

AshPhoenix.LiveView.SubdomainHook in the ash-project/ash_phoenix Elixir library (versions 2.1.26 through before 2.3.25) contains a broken access control flaw. The handle_subdomain authorization callback was invoked during on_mount/4 , before the tenant assign was written by the handle_params hook...

CVE-2026-82726

CVE-2026-82726 is a permissive regular expression vulnerability in ash-project ash_phoenix (versions 2.1.26 through before 2.3.25). The function AshPhoenix.Helpers.get_subdomain/2 interpolated the root host raw into a regex, turning each dot into a wildcard and allowing metacharacters as pattern ...

CVE-2026-82727

ash_phoenix (by ash-project) has a sensitive information disclosure in AshPhoenix.Form.Auto 's union sub-form handling. When the submitted _union_type parameter does not match a configured type, the raised error message embeds the full raw parameter map via inspect(params, pretty: true). Because ...