# CVE-2026-82681: ash-project ash_admin improper output encoding in row-action links

Source: https://junglewise.ai/threats/cve-2026-82681-ash-project-ash-admin-improper-output-encoding-in-row-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82681 · Severity: info · Published 2026-08-31

AshAdmin is a web-based administrative dashboard used to manage application data. The vulnerability allows an attacker to craft malicious database records (using specially crafted primary keys) that, when an admin clicks edit or other row-action links, redirects them to unintended pages or performs unauthorized actions like deletion. An attacker could compromise admin workflows and damage data or reputation through credential theft or destructive actions.

Technologies: [Ash-Project Ash Admin](https://junglewise.ai/threats/technologies/ash-admin). Vendors: [Ash-Project](https://junglewise.ai/threats/vendors/ash-project).

## Quick answers

**Is CVE-2026-82681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82681 being exploited in the wild.

**How severe is CVE-2026-82681?** Informational severity, published 31 August 2026.

**Which products and versions are affected?** Ash-Project Ash Admin 0.3.0-rc.0 before 1.3.1.

**Is there a fix for CVE-2026-82681?** A patch was published on 2026-08-31: ash_admin 1.3.1 and later include the fix with URI.encode_query/1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82681 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82681?** Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Table, DataTable, and Show components in ash_admin construct row-action URLs using raw string interpolation without URL-encoding the primary key and other interpolated values. Because Elixir/Phoenix's Plug.Conn.Query resolver uses a "last-wins" strategy for duplicate query parameters and the primary_key is interpolated last, a malicious string primary key (e.g., "foo&action_type=destroy") can inject parameters that override the intended link target. Additionally, a "#" character in the key truncates the query into a fragment. The fix implements proper URL encoding using URI.encode_query/1 for all interpolated values. Network reachable; requires ability to control a record's primary key (common in slugs, emails, or user-settable identifiers). An attacker can redirect admin actions to arbitrary targets or operations.

## Affected products

- ash-project ash_admin 0.3.0-rc.0 before 1.3.1

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: patched: ash_admin 1.3.1 and later include the fix with URI.encode_query/1

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [ash-project ash_admin resource exhaustion in LiveView handlers](https://junglewise.ai/threats/cve-2026-82722-ash-project-ash-admin-resource-exhaustion-in-liveview-handlers)
- [ash-project ash_admin path traversal in file upload](https://junglewise.ai/threats/cve-2026-82673-ash-project-ash-admin-path-traversal-in-file-upload)
- [ash-project ash_admin authorization bypass via user-controlled key](https://junglewise.ai/threats/cve-2026-81853-ash-project-ash-admin-authorization-bypass-via-user-controlled)
- [ash-project ash_admin hardcoded CSP nonce bypass](https://junglewise.ai/threats/cve-2026-81852-ash-project-ash-admin-hardcoded-csp-nonce-bypass)
- [ash-project ash_admin stored cross-site scripting in relationship fields](https://junglewise.ai/threats/cve-2026-77850-ash-project-ash-admin-stored-cross-site-scripting-in-relationship)