Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_phoenix

4 known vulnerabilities (1 high, 1 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 high, 1 medium, 2 low
Registry
Hex

Advisories 4

  • AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

    Affected: from 0.6.0-rc.1, fixed in 2.3.25; from 0.6.0-rc.1, fixed in 2.3.25.

  • Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

    Affected: from 2.1.26, fixed in 2.3.25; from 2.1.26, fixed in 2.3.25.

  • CVE-2026-82726Medium 6.3

    AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

    Affected: from 2.1.26, fixed in 2.3.25; from 2.1.26, fixed in 2.3.25.

  • AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

    Affected: from 1.2.17, fixed in 2.3.25; from 1.2.17, fixed in 2.3.25.