Executive brief
AshAdmin is a web-based administrative dashboard used to manage application data. The vulnerability allows an attacker to craft malicious database records (using specially crafted primary keys) that, when an admin clicks edit or other row-action links, redirects them to unintended pages or performs unauthorized actions like deletion. An attacker could compromise admin workflows and damage data or reputation through credential theft or destructive actions.
Technical details
The Table, DataTable, and Show components in ash_admin construct row-action URLs using raw string interpolation without URL-encoding the primary key and other interpolated values. Because Elixir/Phoenix's Plug.Conn.Query resolver uses a "last-wins" strategy for duplicate query parameters and the primary_key is interpolated last, a malicious string primary key (e.g., "foo&action_type=destroy") can inject parameters that override the intended link target. Additionally, a "#" character in the key truncates the query into a fragment. The fix implements proper URL encoding using URI.encode_query/1 for all interpolated values. Network reachable; requires ability to control a record's primary key (common in slugs, emails, or user-settable identifiers). An attacker can redirect admin actions to arbitrary targets or operations.
Affected products
- ash-project ash_admin 0.3.0-rc.0 before 1.3.1
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: ash_admin 1.3.1 and later include the fix with URI.encode_query/1