GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-82727 (GCVE-0-2026-82727)

Vulnerability from cvelistv5 – Published: 2026-08-31 03:03 – Updated: 2026-08-31 14:49
VLAI
Title
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps. This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:49 UTC
CWE
  • CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
Impacted products
Vendor Product Version CPE status
ash-project ash_phoenix Affected: 1.2.17 , < 2.3.25 (semver)
    cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*
Create a notification for this product.
ash-project ash_phoenix Affected: a3436fcc321e3b34c242cceaf62c3c92bc1a452b , < 0c1775c3cf8988f9abd10a8f92315afc5f06f16d (git)
    cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Peter Ullrich Peter Ullrich Zach Daniel / Ash Project Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82727",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:49:02.912896Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:49:25.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPhoenix.Form.Auto\u0027"
          ],
          "packageName": "ash_phoenix",
          "packageURL": "pkg:hex/ash_phoenix",
          "product": "ash_phoenix",
          "programFiles": [
            "lib/ash_phoenix/form/auto.ex"
          ],
          "repo": "https://github.com/ash-project/ash_phoenix",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "2.3.25",
              "status": "affected",
              "version": "1.2.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshPhoenix.Form.Auto\u0027"
          ],
          "packageName": "ash-project/ash_phoenix",
          "packageURL": "pkg:github/ash-project/ash_phoenix",
          "product": "ash_phoenix",
          "programFiles": [
            "lib/ash_phoenix/form/auto.ex"
          ],
          "repo": "https://github.com/ash-project/ash_phoenix",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0c1775c3cf8988f9abd10a8f92315afc5f06f16d",
              "status": "affected",
              "version": "a3436fcc321e3b34c242cceaf62c3c92bc1a452b",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application renders an \u003ccode\u003eAshPhoenix.Form\u003c/code\u003e with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
            }
          ],
          "value": "The application renders an AshPhoenix.Form with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.25",
                  "versionStartIncluding": "1.2.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAshPhoenix.Form.Auto\u003c/code\u003e builds a union sub-form and the submitted \u003ccode\u003e_union_type\u003c/code\u003e does not match a configured type, both raise sites built the message with \u003ccode\u003einspect(params, pretty: true)\u003c/code\u003e, embedding the full untrusted param map, and also inspected the internal union \u003ccode\u003econstraints[:types]\u003c/code\u003e. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, \u003ccode\u003econfig :phoenix, :filter_parameters\u003c/code\u003e never redacts it. An attacker controls both the trigger and the contents: submitting \u003ccode\u003e%{\"_union_type\" =\u0026gt; \"nope\", \"password\" =\u0026gt; \"...\"}\u003c/code\u003e puts the password verbatim in the raised message. The fix reports only the offending \u003ccode\u003e_union_type\u003c/code\u003e and the valid type names, dropping the param and constraints dumps.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
            }
          ],
          "value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-54",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-54 Query System for Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T03:03:58.982Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82727.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82727"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82727",
    "datePublished": "2026-08-31T03:03:58.982Z",
    "dateReserved": "2026-08-31T00:59:08.960Z",
    "dateUpdated": "2026-08-31T14:49:25.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82727",
      "date": "2026-09-17",
      "epss": "0.00268",
      "percentile": "0.19096"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82727\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-08-31T04:17:29.560\",\"lastModified\":\"2026-09-01T21:15:00.147\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\\n\\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\\\"_union_type\\\" =\u003e \\\"nope\\\", \\\"password\\\" =\u003e \\\"...\\\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\\n\\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash_phoenix\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_phoenix\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshPhoenix.Form.Auto\u0027\"],\"programFiles\":[\"lib/ash_phoenix/form/auto.ex\"],\"repo\":\"https://github.com/ash-project/ash_phoenix\",\"packageURL\":\"pkg:hex/ash_phoenix\",\"versions\":[{\"version\":\"1.2.17\",\"lessThan\":\"2.3.25\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash_phoenix\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash_phoenix\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshPhoenix.Form.Auto\u0027\"],\"programFiles\":[\"lib/ash_phoenix/form/auto.ex\"],\"repo\":\"https://github.com/ash-project/ash_phoenix\",\"packageURL\":\"pkg:github/ash-project/ash_phoenix\",\"versions\":[{\"version\":\"a3436fcc321e3b34c242cceaf62c3c92bc1a452b\",\"lessThan\":\"0c1775c3cf8988f9abd10a8f92315afc5f06f16d\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-31T14:49:02.912896Z\",\"id\":\"CVE-2026-82727\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82727.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82727\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82727\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-31T14:49:02.912896Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-31T14:49:21.634Z\"}}], \"cna\": {\"title\": \"AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Zach Daniel / Ash Project\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-54\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-54 Query System for Information\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_phoenix\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshPhoenix.Form.Auto\u0027\"], \"product\": \"ash_phoenix\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.2.17\", \"lessThan\": \"2.3.25\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash_phoenix\", \"packageName\": \"ash_phoenix\", \"programFiles\": [\"lib/ash_phoenix/form/auto.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_phoenix\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshPhoenix.Form.Auto\u0027\"], \"product\": \"ash_phoenix\", \"versions\": [{\"status\": \"affected\", \"version\": \"a3436fcc321e3b34c242cceaf62c3c92bc1a452b\", \"lessThan\": \"0c1775c3cf8988f9abd10a8f92315afc5f06f16d\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/ash_phoenix\", \"packageName\": \"ash-project/ash_phoenix\", \"programFiles\": [\"lib/ash_phoenix/form/auto.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-82727.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82727\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\\n\\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\\\"_union_type\\\" =\u003e \\\"nope\\\", \\\"password\\\" =\u003e \\\"...\\\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\\n\\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\u003c/p\u003e\\n\u003cp\u003eWhen \u003ccode\u003eAshPhoenix.Form.Auto\u003c/code\u003e builds a union sub-form and the submitted \u003ccode\u003e_union_type\u003c/code\u003e does not match a configured type, both raise sites built the message with \u003ccode\u003einspect(params, pretty: true)\u003c/code\u003e, embedding the full untrusted param map, and also inspected the internal union \u003ccode\u003econstraints[:types]\u003c/code\u003e. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, \u003ccode\u003econfig :phoenix, :filter_parameters\u003c/code\u003e never redacts it. An attacker controls both the trigger and the contents: submitting \u003ccode\u003e%{\\\"_union_type\\\" =\u0026gt; \\\"nope\\\", \\\"password\\\" =\u0026gt; \\\"...\\\"}\u003c/code\u003e puts the password verbatim in the raised message. The fix reports only the offending \u003ccode\u003e_union_type\u003c/code\u003e and the valid type names, dropping the param and constraints dumps.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\\n\\nWhen `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{\\\"_union_type\\\" =\u003e \\\"nope\\\", \\\"password\\\" =\u003e \\\"...\\\"}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps.\\n\\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-209\", \"description\": \"CWE-209 Generation of Error Message Containing Sensitive Information\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application renders an AshPhoenix.Form with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application renders an \u003ccode\u003eAshPhoenix.Form\u003c/code\u003e with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"The application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.3.25\", \"versionStartIncluding\": \"1.2.17\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-08-31T03:03:58.982Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82727\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-31T14:49:25.154Z\", \"dateReserved\": \"2026-08-31T00:59:08.960Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-08-31T03:03:58.982Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.