A flaw in Ash.Resource.Validation.Confirm allows a user who fails a confirmation check to receive a mismatch error that contains the field's stored value. The error generation is based on an atomic implementation that, when the confirmation argument is supplied without the original field value, retrieves the current stored value and echoes it back to the caller, exposing sensitive data. This is a classic Information Exposure Through an Error Message weakness (CWE-209), enabling attackers to discover confidential configuration or user data without any additional privileges.

The vulnerability applies to the Ash web framework released by ash-project, affecting all versions from 2.17.20 up to, but not including, 3.32.2. It triggers whenever any actor submits a confirmation value for a sensitive field that does not match the stored value.

The CVSS score of 2.1 reflects a low severity, and the EPSS score is unavailable while remaining absent from the CISA KEV catalog, indicating no widespread exploitation is known. The likely attack vector is local or remote request to a validation endpoint; any user capable of interacting with the API can intentionally provide an incorrect confirmation to trigger the error response and read the leaked value. As the flaw discloses data rather than enabling execution or privilege escalation, the overall risk to confidentiality remains low‑moderate, especially if the framework is used to protect sensitive attributes.