{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
            "\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
            "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
          ],
          "packageName": "ash_admin",
          "packageURL": "pkg:hex/ash_admin",
          "product": "ash_admin",
          "programFiles": [
            "lib/ash_admin/components/resource/table.ex",
            "lib/ash_admin/components/resource/data_table.ex",
            "lib/ash_admin/components/resource/show.ex"
          ],
          "repo": "https://github.com/ash-project/ash_admin",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "1.3.1",
              "status": "affected",
              "version": "0.3.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAdmin.Components.Resource.Table\u0027",
            "\u0027Elixir.AshAdmin.Components.Resource.DataTable\u0027",
            "\u0027Elixir.AshAdmin.Components.Resource.Show\u0027"
          ],
          "packageName": "ash-project/ash_admin",
          "packageURL": "pkg:github/ash-project/ash_admin",
          "product": "ash_admin",
          "programFiles": [
            "lib/ash_admin/components/resource/table.ex",
            "lib/ash_admin/components/resource/data_table.ex",
            "lib/ash_admin/components/resource/show.ex"
          ],
          "repo": "https://github.com/ash-project/ash_admin",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "8e8ef91e8ba07498053887c6212f8b0f08178df6",
              "status": "affected",
              "version": "b214535f0cc012e36ca621e643bf8f7b133ba354",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.3.1",
                  "versionStartIncluding": "0.3.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eTable\u003c/code\u003e, \u003ccode\u003eDataTable\u003c/code\u003e, and \u003ccode\u003eShow\u003c/code\u003e components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because \u003ccode\u003ePlug.Conn.Query\u003c/code\u003e resolves duplicate parameters last-wins and \u003ccode\u003eprimary_key\u003c/code\u003e is interpolated last, a stored key such as \u003ccode\u003efoo\u0026amp;action_type=destroy\u003c/code\u003e injects parameters that override the link, so an admin clicking \u003ccode\u003eedit\u003c/code\u003e is sent to a destroy form or an arbitrary resource; a \u003ccode\u003e#\u003c/code\u003e truncates the query into a fragment. The fix builds every link with \u003ccode\u003eURI.encode_query/1\u003c/code\u003e, encoding all interpolated values.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe `Table`, `DataTable`, and `Show` components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because `Plug.Conn.Query` resolves duplicate parameters last-wins and `primary_key` is interpolated last, a stored key such as `foo\u0026action_type=destroy` injects parameters that override the link, so an admin clicking `edit` is sent to a destroy form or an arbitrary resource; a `#` truncates the query into a fragment. The fix builds every link with `URI.encode_query/1`, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
            }
          ],
          "value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record\u0027s string primary key rewrite the target of AshAdmin\u0027s row-action links.\n\nThe Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo\u0026action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.\n\nThis issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-460",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T02:26:05.357Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82681.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82681"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Query-parameter injection in AshAdmin row-action links via unencoded string primary keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82681",
    "datePublished": "2026-08-31T02:26:05.357Z",
    "dateReserved": "2026-08-30T23:15:02.375Z",
    "dateUpdated": "2026-08-31T02:26:05.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}