The vulnerability stems from a permissive regular expression that removes the configured root domain from user input without proper escaping or anchoring. This allows a remote client to manipulate the Host header so that the application treats an unauthorized subdomain as the tenant. The flaw can also degrade normal requests or trigger errors when the root host contains metacharacters or is nil. The impact is that an attacker can gain access to data belonging to another tenant or disrupt tenant isolation, compromising confidentiality and availability for the affected tenants.

ash-project ash_phoenix versions from 2.1.26 up to but not including 2.3.25 are affected. The specific product is the ash_phoenix framework, which is used to host multi‑tenant applications.

The CVSS score of 6.3 indicates moderate severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by HTTP requests that include a crafted Host header, a remote attacker can exploit it over the public network without any authentication. The attack requires only the ability to send an HTTP request with a malicious Host field, which is typically trivial for an attacker who can reach the target. The exploit path is straightforward: send a Host header that contains a specially crafted domain that satisfies the vulnerable regular expression and receives a tenant context otherwise reserved for another tenant.