EEF-CVE-2026-82725

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

## Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data. `AshPhoenix.FilterForm` resolved every relationship hop in the user-supplied `path` with `Ash.Resource.Info.related/2`, which traverses private relationships, and only checked the terminal field for publicity. `parse_path_and_field/2` also rewrote a `field` naming a relationship into an extra path segment, so `field=some_private_rel` was accepted too. Both `path` and `field` come straight from form params, and the resulting ref went to `Ash.Query.do_filter/2` without the public-only enforcement of `Ash.Filter.parse_input/2`. The fix resolves each hop with `Ash.Resource.Info.public_relationship/2`, rejecting the first non-public hop, and requires the terminal field to be public. This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25. ## Configurations The resource exposes an `AshPhoenix.FilterForm` whose params the attacker controls, and has a non-public relationship to data that should not be filterable.