Sensitive Information Exposure in AshPhoenix by Ash Project

CVE-2026-82727

What is CVE-2026-82727?

An exposure of sensitive information vulnerability exists in the AshPhoenix framework, where the raw parameters submitted through union form fields are included in error messages. This flaw allows attackers to see sensitive data, such as passwords, in logs or error reports. When invalid types are submitted, the combination of the full parameter map and internal constraints are logged without proper redaction, potentially disclosing sensitive data. As a response, the fix restricts the information displayed in error messages to only highlight the invalid type and valid options, thus mitigating the risk of sensitive data exposure.

References