CVE-2026-82732: ash_typescript Auth Bypass Vulnerability

CVE-2026-82732 Overview

CVE-2026-82732 is an improper input validation vulnerability [CWE-20] in the ash-project/ash_typescript library. The flaw resides in AshTypescript.TypedController.RequestHandler at lib/ash_typescript/typed_controller/request_handler.ex. The handler calls Ash.Type.cast_input/3 and treats the returned {:ok, cast} tuple as fully validated input. In the Ash framework, casting and constraint enforcement are separate steps, and this path never invokes Ash.Type.apply_constraints/3. Declared constraints such as one_of, max_length, min, max, and match are therefore inert on typed-controller routes. Affected versions span 0.15.0 up to but not including 0.18.0.

Critical Impact

Remote attackers can submit argument values outside a declared allowlist or bound, enabling privilege or state-machine bypass when constraints gate a role, status, or sort direction.

Affected Products

• ash_typescript versions >= 0.15.0
• ash_typescript versions < 0.18.0
• Elixir applications using AshTypescript.TypedController typed-controller routes

Discovery Timeline

• 2026-09-01 - CVE CVE-2026-82732 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82732

Vulnerability Analysis

The vulnerability stems from a mismatch between Ash framework semantics and how ash_typescript processes controller inputs. AshTypescript.TypedController.RequestHandler invokes Ash.Type.cast_input/3 to coerce user-supplied terms into the declared argument type. It then treats the {:ok, cast} result as a fully validated value.

In Ash, cast_input/3 performs coercion only. Constraint enforcement lives in Ash.Type.apply_constraints/3, which the typed-controller request path never calls. As a result, constraints declared on arguments do not execute at runtime. Empty-string to nil normalization also resides in apply_constraints, so an allow_nil?: false argument accepts "" for required fields.

Codegen renders the same constraints into generated TypeScript types. A TypeScript caller sees an enforced allowlist, while any other HTTP client can submit arbitrary values. Where a constraint gates a role, status, or sort direction, the bypass becomes a privilege or state-machine escalation.

Root Cause

The root cause is incomplete adoption of Ash argument semantics in lib/ash_typescript/typed_controller/request_handler.ex. The handler treats casting as validation and omits the constraint application step. Constraints such as one_of, max_length, min, max, and match are declared but never enforced on the server side.

Attack Vector

An unauthenticated remote attacker sends an HTTP request directly to a typed-controller route using any non-browser HTTP client. The attacker supplies argument values that violate the declared constraints, such as a role string outside an one_of allowlist or an empty string for a required field. The route handler receives the unvalidated input and executes downstream logic under attacker-chosen state.

// Security patch excerpt from lib/ash_typescript/codegen/orchestrator.ex
   - ash_types.ts — type aliases, resource schemas, filter types, utility types, custom imports,
                       channel payload type aliases and events maps
   - ash_zod.ts — ALL Zod schemas: resource-level + per-action RPC + per-route controller
+  - ash_valibot.ts — ALL Valibot schemas: resource-level + per-action RPC + per-route controller
   - ash_rpc.ts — imports types from ash_types.ts (no Zod), hook types, helper functions,
                     per-action input types, per-action result types, per-action RPC functions
   - routes.ts — imports types from ash_types.ts (no Zod), static code, per-route path
// Source: https://github.com/ash-project/ash_typescript/commit/21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e

The patch introduces Valibot schema generation and applies full Ash argument semantics, including constraint enforcement, on typed-controller routes.

Detection Methods for CVE-2026-82732

Indicators of Compromise

• HTTP requests to typed-controller routes containing argument values outside declared allowlists, such as unexpected role, status, or sort-direction strings.
• Requests with empty-string values ("") submitted for arguments defined with allow_nil?: false.
• Non-browser user agents or missing TypeScript client fingerprints on routes that are only expected to receive traffic from the generated TypeScript client.

Detection Strategies

• Audit application logs for AshTypescript.TypedController invocations where downstream authorization or state transitions received values not present in the declared one_of constraint list.
• Compare inbound request payloads against the generated TypeScript type constraints and flag divergences at a reverse proxy or WAF layer.
• Enumerate all resource actions whose arguments declare one_of, min, max, max_length, or match and correlate against successful requests carrying out-of-range values.

Monitoring Recommendations

• Instrument the request handler to log the raw value of each argument alongside the resolved action, then alert on values outside the declared allowlist.
• Track anomalies in role assignment, status transitions, and sort parameters that could indicate constraint bypass.
• Ingest web-tier logs into a centralized data lake or SIEM to correlate constraint-violation attempts across services and time windows.

How to Mitigate CVE-2026-82732

Immediate Actions Required

• Upgrade ash_typescript to version 0.18.0 or later, which applies full Ash argument semantics on typed-controller routes.
• Inventory all typed-controller routes and identify arguments where one_of, min, max, max_length, match, or allow_nil?: false constraints gate security-relevant decisions.
• Add server-side authorization checks that do not rely on client-side or generated-type enforcement of allowlists.

Patch Information

The fix is committed in ash_typescript commit 21ab6f1 and shipped in version 0.18.0. It applies Ash argument semantics and generates Valibot route schemas. Refer to the GitHub Security Advisory GHSA-f7fq-hwq6-jhvv and the CNA advisory for CVE-2026-82732 for full advisory details.

Workarounds

• If upgrading is not immediately possible, wrap typed-controller action handlers with explicit calls to Ash.Type.apply_constraints/3 on each argument before dispatching business logic.
• Enforce allowlists at the router or plug layer using pattern matching or a schema library such as Valibot or Ecto changesets.
• Reject empty-string values for required arguments explicitly, since apply_constraints normally handles the empty-string to nil conversion.

# Mix dependency upgrade in mix.exs
{:ash_typescript, "~> 0.18.0"}