{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ash_admin",
          "packageURL": "pkg:hex/ash_admin",
          "product": "ash_admin",
          "programFiles": [
            "assets/js/app.js"
          ],
          "repo": "https://github.com/ash-project/ash_admin",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "1.3.1",
              "status": "affected",
              "version": "0.9.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ash-project/ash_admin",
          "packageURL": "pkg:github/ash-project/ash_admin",
          "product": "ash_admin",
          "programFiles": [
            "assets/js/app.js"
          ],
          "repo": "https://github.com/ash-project/ash_admin",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "e93a3408a85035e1f90275d02bc2470c96095e56",
              "status": "affected",
              "version": "77a43cc4fa04cb59c38fc434568a35a38ecb995a",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.3.1",
                  "versionStartIncluding": "0.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\u003c/p\u003e\n\u003cp\u003eAshAdmin\u0027s client JavaScript read its state cookies (\u003ccode\u003etenant\u003c/code\u003e, \u003ccode\u003eactor_resource\u003c/code\u003e, \u003ccode\u003eactor_primary_key\u003c/code\u003e, \u003ccode\u003eactor_action\u003c/code\u003e, \u003ccode\u003eactor_domain\u003c/code\u003e, \u003ccode\u003eactor_authorizing\u003c/code\u003e, \u003ccode\u003eactor_paused\u003c/code\u003e) by matching the cookie name with an unanchored regular expression (\u003ccode\u003enew RegExp(name + \"=([^;]+)\")\u003c/code\u003e) against the whole \u003ccode\u003edocument.cookie\u003c/code\u003e. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example \u003ccode\u003exactor_authorizing\u003c/code\u003e) with \u003ccode\u003eDomain=.example.com\u003c/code\u003e that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.9.1 before 1.3.1.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (`tenant`, `actor_resource`, `actor_primary_key`, `actor_action`, `actor_domain`, `actor_authorizing`, `actor_paused`) by matching the cookie name with an unanchored regular expression (`new RegExp(name + \"=([^;]+)\")`) against the whole `document.cookie`. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example `xactor_authorizing`) with `Domain=.example.com` that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
            }
          ],
          "value": "Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin\u0027s session to a different actor, tenant, or authorization mode.\n\nAshAdmin\u0027s client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + \"=([^;]+)\")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin\u0027s LiveSocket connect params. The fix matches cookie names by exact equality.\n\nThis issue affects ash_admin: from 0.9.1 before 1.3.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-31",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-565",
              "description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T02:20:17.985Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-75757.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-75757"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-75757",
    "datePublished": "2026-08-31T02:20:17.985Z",
    "dateReserved": "2026-08-30T23:30:01.239Z",
    "dateUpdated": "2026-08-31T02:20:17.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}