Improper Output Encoding Vulnerability in AshAdmin by Ash Project
CVE-2026-82681

2LOW

Key Information:

Vendor

Ash-project

Status
Ash Admin
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82681?

An improper output encoding vulnerability in AshAdmin allows an attacker to control a record's string primary key to rewrite the destination of row-action links. This issue arises from the use of raw string interpolation to construct URLs in the Table, DataTable, and Show components, which failed to properly URL-encode interpolated values. Due to this oversight, an admin could inadvertently be redirected to malicious actions within the application, such as unwanted deletions or arbitrary resources. The vulnerability specifically affects versions of AshAdmin from 0.3.0-rc.0 up to, but not including, 1.3.1. A fix has been implemented to ensure all interpolated values are correctly encoded using URI.encode_query/1.

Affected Version(s)

ash_admin 0.3.0-rc.0 < 1.3.1

ash_admin b214535f0cc012e36ca621e643bf8f7b133ba354 < 8e8ef91e8ba07498053887c6212f8b0f08178df6

References

https://github.com/ash-project/ash_admin/security/advisor...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82681.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-82681
related

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Peter Ullrich
Zach Daniel / Ash Project
Jonatan Männchen / EEF
.