Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Authorization CWE-285 CWE-285 at MITRE
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Incorrect Authorization CWE-863
25
(86.2%)
Missing Authorization CWE-862
4
(13.8%)
Files or Directories Accessible to External Parties CWE-552
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Improper Export of Android Application Components CWE-926
0
(0.0%)
Use of Implicit Intent for Sensitive Communication CWE-927
0
(0.0%)
Exposure of Sensitive Information Through Metadata CWE-1230
0
(0.0%)
Improper Restriction of Software Interfaces to Hardware Features CWE-1256
0
(0.0%)
Unprotected Confidential Information on Device is Accessible by OSAT Vendors CWE-1297
0
(0.0%)
Security Version Number Mutable to Older Versions CWE-1328
0
(0.0%)
Classified as CWE-285 itself, not a child weakness
1
CVEs
CVEs for Improper Authorization CWE-285
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Confirmation token accepted on any record in AshAuthentication | CVE-2026-82685 | 2026-09-17 | |
| AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | CVE-2026-82586 | 2026-09-07 | |
| ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | CVE-2026-82754 | 2026-09-07 | |
| httpd mod_auth directory protection bypassed by a doubled slash in the request path |
Erlang
pkg:otp/inets
|
CVE-2026-66835 | 2026-09-01 |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor | CVE-2026-82747 | 2026-09-01 | |
| Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records | CVE-2026-82749 | 2026-09-01 | |
| Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another | CVE-2026-82748 | 2026-09-01 | |
| Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records | CVE-2026-82746 | 2026-09-01 | |
| Authorization-redacted field values disclosed through AshTypescript result normalization | CVE-2026-82730 | 2026-09-01 | |
| AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data | CVE-2026-82725 | 2026-08-31 | |
| Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain | CVE-2026-82724 | 2026-08-31 | |
| AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle | CVE-2026-81853 | 2026-08-31 | |
| Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records | CVE-2026-82564 | 2026-08-31 | |
| Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read | CVE-2026-80223 | 2026-08-30 | |
| Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification | CVE-2026-81643 | 2026-08-30 | |
| exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql | CVE-2026-77454 | 2026-08-30 | |
| Same-named aggregates with differing filters are conflated in AshSql | CVE-2026-81316 | 2026-08-30 | |
| Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql | CVE-2026-81318 | 2026-08-30 | |
| OAuth token exchange grants repository scopes for organizations the principal cannot access | CVE-2026-75542 | 2026-08-24 | |
| Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding | CVE-2026-48599 | 2026-06-15 | |
| Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist |
Erlang / ssl
|
CVE-2026-48860 | 2026-06-10 |
| Missing authorization check on save-job event handler in oban_web | CVE-2026-48592 | 2026-05-26 | |
| Cross-session PubSub topic injection via URL parameter in phoenix_storybook | CVE-2026-47068 | 2026-05-20 | |
| ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) |
Erlang
Erlang / inets
|
CVE-2026-28808 | 2026-04-07 |
25 per page ·
30 CVEs