Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.

When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.

This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
Published: 2026-08-31
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability occurs when AshPhoenix.Form.Auto builds a union sub-form and receives an unknown _union_type. Instead of logging only the offending type, the library constructs an error message that includes the entire raw submitted parameter map and internal union constraints. This means that any secrets sent in the request, such as passwords, are exposed in logs, crash reports, and the developer error page. The weakness is identified as CWE‑209: Information Exposure Through an Error Message.

Affected Systems

The issue affects the ash-project ash_phoenix library, versions from 1.2.17 up to, but not including, 2.3.25.

Risk and Exploitability

The CVSS score is 2.3, indicating low complexity and low initial impact. Because the attacker controls both the trigger and the contents, the likely attack vector is over the network by submitting a crafted request containing an invalid _union_type and arbitrary data such as a password, which causes the library to raise an error that includes the full raw parameter map in logs or error pages. This inference is based on the description stating that the attacker can control the inputs that trigger the error. The EPSS score is not available and the vulnerability is not listed in KEV.

Generated by OpenCVE AI on August 31, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash_phoenix to version 2.3.25 or later to apply the vendor fix that removes the raw parameter dump from the error message.
  • Verify that the error message now contains only the offending _union_type and the list of valid types, and that secrets are no longer present in logs or error pages.
  • Ensure that production deployments are configured to suppress detailed error pages (e.g., set environment to prod) so that even if a malformed request occurs, sensitive data cannot be displayed to end users.

Generated by OpenCVE AI on August 31, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps. This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
Title AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
First Time appeared Ash-project
Ash-project ash Phoenix
Weaknesses CWE-209
CPEs cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Phoenix
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Phoenix
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T14:49:25.154Z

Reserved: 2026-08-31T00:59:08.960Z

Link: CVE-2026-82727

cve-icon Vulnrichment

Updated: 2026-08-31T14:49:21.634Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T04:17:29.560

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-82727

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:22:09Z

Weaknesses
  • CWE-209

    Generation of Error Message Containing Sensitive Information