ash-project ash_phoenix

• CVE-2026-82725 Low 2.3 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data 0.4%
• CVE-2026-82724 High 7.6 Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain 0.4%
• CVE-2026-82726 Medium 6.3 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant 0.5%
• CVE-2026-82727 Low 2.3 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message 0.5%