Answer in brief
CVE-2026-82727 records a Low severity (CVSS 2.3) vulnerability in AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_phoenix (generic), ash-project/ash_phoenix (generic), ash-project/ash-project/ash_phoenix (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_phoenix (generic), ash-project/ash_phoenix (generic), ash-project/ash-project/ash_phoenix (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_phoenixgeneric | >=a3436fcc321e3b34c242cceaf62c3c92bc1a452b <0c1775c3cf8988f9abd10a8f92315afc5f06f16d | 0c1775c3cf8988f9abd10a8f92315afc5f06f16d |
| ash-project/ash_phoenixgeneric | >=1.2.17 <2.3.25 | 2.3.25 |
| ash-project/ash-project/ash_phoenixgeneric | >=a3436fcc321e3b34c242cceaf62c3c92bc1a452b <0c1775c3cf8988f9abd10a8f92315afc5f06f16d | 0c1775c3cf8988f9abd10a8f92315afc5f06f16d |
Published upstream
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 31, 2026
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps. This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
Quoted source text, attributed separately from HOL analysis.