EEF-CVE-2026-82725
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
Quick fix
EEF-CVE-2026-82725 — ash_phoenix: upgrade to the fixed version with the command below.
mix deps.update ash_phoenixDetails
## Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash\_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.
AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse\_path\_and\_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some\_private\_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do\_filter/2 without the public-only enforcement of Ash.Filter.parse\_input/2. The fix resolves each hop with Ash.Resource.Info.public\_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.
This issue affects ash\_phoenix: from 0.6.0-rc.1 before 2.3.25.
## Configuration
The resource exposes an AshPhoenix.FilterForm whose params the attacker controls, and has a non-public relationship to data that should not be filterable.
Are you affected?
Enter the version of the package you're using.