A flaw in Ash Admin allows the composite‑primary‑key decoding routine to return a map of user‑controlled attributes without validating that the keys are actual primary‑key fields. When that map is used as a lookup filter, an attacker can embed sensitive attribute names such as api_token or reset_token and test guesses one equality at a time, turning the record‑lookup endpoint into an equality oracle. The result is a direct authorization bypass that permits brute‑force discovery of confidential tokens or reset keys, compromising account security and privacy.

The vulnerability affects the Ash Project’s Ash Admin application, specifically any release from version 0.1.0 up to, but not including, 1.3.1. Products are identified as ash-project:ash_admin, and all builds within this range are impacted.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score is not available, but the vulnerability can be leveraged by anyone who can reach the record‑lookup URL, which is often publicly accessible. The exploitation requires only crafting HTTP requests with a Base64‑encoded composite key payload; no privileged code execution is needed. Because the attack surface consists of repeated equality checks, attackers can iterate over possible token values, potentially revealing secrets if rate limits or monitoring are absent. The vulnerability is not currently listed in the CISA KEV catalog, which suggests that publicly known exploits are scarce, yet the basic attack remains straightforward and could be combined with other weaknesses to achieve deeper compromise.