Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-82727: AshPhoenix Form.Auto exposes submitted data in error messages
CVE-2026-82727 · published 2 months ago
Summary
The AshPhoenix library can include all user‑submitted form fields, including passwords, in the error text it generates when a union form field is invalid. This means sensitive information may be written to logs, crash reports, or shown on development error pages. Update to the latest version of ash_phoenix where the error message now only shows the problematic field name and allowed types, without leaking actual input values.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ash-project | ash_phoenix |
< 2.3.25 < 0c1775c3cf8988f9abd10a8f92315afc5f06f16d |
Original advisory text
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.
When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.
This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.
This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
References
- https://github.com URL
- https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw... Vendor Advisory
- https://cna.erlef.org/cves/CVE-2026-82727.html URL
- https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315a... Patch
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82727... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-82727 Vendor Advisory
- https://github.com/ash-project/ash_phoenix Product
- https://osv.dev/vulnerability/EEF-CVE-2026-82727 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published31 Aug 2026
Updated4 Nov 2026
First seen31 Aug 2026
Track software like this
Free during beta