The vulnerability is an authorization bypass that lets an attacker, by controlling filter form parameters, traverse relationships marked as non‑public in the AshPhoenix application. This turns the query result into a boolean oracle that reveals the existence or absence of private related data, effectively disclosing sensitive information that should remain hidden. The flaw is rooted in the CWE‑639 weakness, where unchecked user input enables unauthorized data access.

The impacted product is ash-project’s AshPhoenix framework. Versions from 0.6.0‑rc.1 up through the release preceding 2.3.25 are affected, as the fix was introduced in 2.3.25 to enforce public‑only relationship traversal. All deployments of AshPhoenix in those version ranges should be considered vulnerable.

The vulnerability carries a CVSS score of 2.3, indicating a low severity level, and its EPSS score is not available; it is not listed in the CISA KEV catalog. Nonetheless, because the flaw allows the extraction of private data by manipulating request parameters, an attacker could exploit it with a simple crafted HTTP request to the filter endpoint. The attack vector is client‑side input manipulation, requiring no additional privileges, and the impact is limited to accidental data leakage rather than a full denial of service or code execution.