CVE-2026-115635
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Incorrect Authorization vulnerability in ash_postgres allows a user to read another tenant's record through a skipped upsert. When a create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped, the data layer reads the existing row by upsert identity without applying attribute multitenancy, potentially exposing another tenant's fields.
Risk Assessment
Organizations using attribute multitenancy in ash_postgres may face cross-tenant data leakage, violating data isolation and potentially exposing sensitive information.
Recommendation
Update ash_postgres to version 2.15.2 or later to remediate the vulnerability.
Other vulnerabilities in ash_postgres
See all- CVE-2026-115627Medium
Incorrect Authorization vulnerability in ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many or through relationship is loaded with a lateral join, the query for the join resource is built without running its read action, which applies attribute multitenancy, causing rows from other tenants to be joined.
- CVE-2026-78699High
A vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data. The rename_tenant/3 function ignores the SQL query result and always returns :ok, leading to the new name being saved and subsequent access to other tenants' data. Affects ash_postgres from 0.25.0 before 2.13.0.
Original NVD description (English source)
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS