{"id":"EEF-CVE-2026-82732","summary":"Declared argument constraints not enforced on AshTypescript typed controller routes","details":"## Summary\n\nImproper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.\n\n`AshTypescript.TypedController.RequestHandler` in `lib/ash_typescript/typed_controller/request_handler.ex` calls `Ash.Type.cast_input/3` and treats an `{:ok, cast}` result as fully validated. In Ash these are separate steps: `cast_input/3` only coerces the term, while every constraint declared on the argument is applied by `Ash.Type.apply_constraints/3`, which this path never calls. Constraints such as `one_of`, `max_length`, `min` and `max`, and `match` are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to `nil` normalization also lives in `apply_constraints`, so the `allow_nil?: false` check accepts `\"\"` for a required argument.\n\nWhere a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\n\n## Configurations\n\nThe application exposes an AshTypescript typed controller over HTTP with at least one route argument carrying a `constraints` declaration that gates application behaviour.","aliases":["CVE-2026-82732","GHSA-f7fq-hwq6-jhvv"],"modified":"2026-09-08T03:30:04.089399911Z","published":"2026-09-01T02:09:15.070Z","database_specific":{"capec_ids":["CAPEC-153"],"cpe_ids":["cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-20"]},"references":[{"type":"ADVISORY","url":"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-f7fq-hwq6-jhvv"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-82732.html"},{"type":"FIX","url":"https://github.com/ash-project/ash_typescript/commit/21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash_typescript"}],"affected":[{"package":{"name":"ash_typescript","ecosystem":"Hex","purl":"pkg:hex/ash_typescript"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.15.0"},{"fixed":"0.18.0"}]}],"versions":["0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-82732.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/ash_typescript","events":[{"introduced":"546a15e1a2d7dbf1df2d5a6ee4404bc3da87852e"},{"fixed":"21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e"}]}],"versions":["v0.15.0","v0.15.3","v0.15.2","v0.15.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-82732.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Torkild Gundersen Kjevik / Ash Project","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}