Authorization Flaw in Ash Phoenix Affects User Access Control

CVE-2026-82724

What is CVE-2026-82724?

An incorrect authorization vulnerability in the Ash Phoenix framework allows improper tenant-scoped access checks. The flaw arises because the SubdomainHook authorization callback operates with a nil tenant, preventing it from enforcing the intended access controls. As a result, the initial access evaluation may evaluate to nil, either causing a crash or erroneously granting access. This issue occurs in versions before 2.3.25, where an update has been issued to correct the functionality by ensuring that the tenant assignment is properly handled within the access check lifecycle.

References