2.1

CVE-2026-82739

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.

Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.

This issue affects ash: from 2.17.20 before 3.32.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerash-project
≫
Produkt ash
Default Statusunaffected
Version 2.17.20
Version < 3.32.2
Status affected
Herstellerash-project
≫
Produkt ash
Default Statusunaffected
Version fadecf3ee95640bd3bc7298df4799e0375537fd2
Version < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.026
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
6b3ad84c-e1a6-4bf7-a703-f496b71e49db 2.1 0 0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v
https://cna.erlef.org/cves/CVE-2026-82739.html
https://osv.dev/vulnerability/EEF-CVE-2026-82739
https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b