CVE-2026-82724

CVE-2026-82724 is an incorrect-authorization flaw (CWE-863) in ash_phoenix, the Phoenix LiveView integration for the Ash Framework, where AshPhoenix.LiveView.SubdomainHook.on_mount/4 calls handle_subdomain before the tenant assign it is meant to read has been set. Because the tenant assign is only written later in handle_params, strictly after on_mount returns, the hook runs with a nil tenant (apply(m, f, [socket, nil | a])), so tenant-scoped authorization callbacks in the consumer gate never see the tenant they are supposed to enforce. Depending on how a given gate treats nil, it either crashes or takes a permissive branch, and the check is never re-run once the real subdomain tenant is assigned or on later navigations, so an attacker could gain cross-tenant access in applications where the gate fails open. Only applications built with ash_phoenix 2.1.26 up to (but not including) 2.3.25 that attach the SubdomainHook for subdomain-based multi-tenancy are affected; the flaw is network-reachable with high confidentiality and integrity impact but requires low privileges and no user interaction per its CVSS 4.0 score of 7.6. No public proof-of-concept, no CISA KEV listing, and a low EPSS probability of 0.2% (16th percentile) indicate no exploitation has been observed.

What to do: Upgrade to ash_phoenix 2.3.25 or later, which runs handle_subdomain inside the handle_params hook with the real tenant on every navigation. Until you upgrade, audit consumer gates invoked via SubdomainHook to confirm they halt (fail closed) on a nil tenant rather than taking a permissive branch, and identify which LiveViews attach the hook. Because the check was never re-run after the tenant was assigned on affected versions, consider re-validating tenant membership for sessions that passed through vulnerable builds.