Improper encoding of URL query components in the AshAdmin components allows an attacker who controls a record’s string primary key to craft malicious keys such as foo&action_type=destroy. When the key is interpolated into a row-action link without URL‑encoding, the query string becomes malformed and the duplicate parameters are resolved by the last‑wins rule. This allows the attacker to overwrite admin‑provided parameters, redirecting an admin’s click from an edit action to a destroy form or other arbitrary resource. The vulnerability is a classic instance of CWE‑116 that can lead to unauthorized destructive actions against the system.

The flaw is present in the ash-admin project, affecting all released versions from 0.3.0‑rc.0 through before 1.3.1. The problematic modules are the Table, DataTable, and Show components that build row‑action URLs by raw string interpolation.

The CVSS score of 2.0 indicates a low severity impact, and the EPSS score is not available at present. The issue is not listed in the CISA KEV catalog. The attack requires the attacker to have the ability to create or otherwise control a record with a crafted string primary key, which could be achieved via the application’s own CRUD facilities or an API. Once the key is in place, an unsuspecting administrator is likely to be redirected to an unintended action, potentially leading to unauthorized deletion or other destructive operations. The exploit is straightforward and does not require complex prerequisites, but because it requires the admin to click a link, its likelihood of use may be limited to targeted or socially engineered scenarios.