Refine your search
4 vulnerabilities found for ash_postgres by ash-project
CVE-2026-115627 (GCVE-0-2026-115627)
Vulnerability from cvelistv5
Published
2026-10-25 19:49
Modified
2026-10-26 14:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.
This issue affects ash_postgres: from 0.38.0 before 2.15.2.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_postgres |
Version: 0.38.0 ≤ cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:27:42.624297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "0.38.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8c25c945c39a45299193fe70b09fc2fa2aacac7b",
"status": "affected",
"version": "7115bec58678f13b1ac2fb4822a0ba1aea9dbec5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when the join resource of a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a resource along a \u003ccode\u003ethrough\u003c/code\u003e path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when the join resource of a `many_to_many` relationship, or a resource along a `through` path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"value": "Reachable when the join resource of a many_to_many relationship, or a resource along a through path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "0.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a \u003ccode\u003ethrough\u003c/code\u003e relationship, is loaded with a lateral join (for example with a per-record limit or sort), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e builds the query for the join resource, and for each resource along a \u003ccode\u003ethrough\u003c/code\u003e path, in \u003ccode\u003elateral_join_query/3\u003c/code\u003e and \u003ccode\u003ethrough_step_queries/4\u003c/code\u003e without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use \u003ccode\u003estrategy :attribute\u003c/code\u003e multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 0.38.0 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a `many_to_many` relationship, or a `through` relationship, is loaded with a lateral join (for example with a per-record limit or sort), `AshPostgres.DataLayer` builds the query for the join resource, and for each resource along a `through` path, in `lateral_join_query/3` and `through_step_queries/4` without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use `strategy :attribute` multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
],
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:49:50.510Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "AshPostgres ignores attribute multitenancy on the join resource when loading `many_to_many` and `through` relationships, returning records related through other tenants\u0027 rows",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2"
},
{
"name": "EEF CNA record for CVE-2026-115627",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115627.html"
},
{
"name": "OSV record EEF-CVE-2026-115627",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115627"
},
{
"name": "Introducing commit 7115bec in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5"
},
{
"name": "Fix commit 8c25c94 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants\u0027 rows"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115627",
"datePublished": "2026-10-25T19:49:50.510Z",
"dateReserved": "2026-10-23T13:00:02.154Z",
"dateUpdated": "2026-10-26T14:35:21.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115635 (GCVE-0-2026-115635)
Vulnerability from cvelistv5
Published
2026-10-25 19:48
Modified
2026-10-26 14:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.
This issue affects ash_postgres: from 2.6.22 before 2.15.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_postgres |
Version: 2.6.22 ≤ cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:29:19.217057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.6.22",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8aa81220c401cae412d21078d11b3519ea25d3a9",
"status": "affected",
"version": "af0903f1380468bbe1b61fe65acb33772b5e24a5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy, an action performs upserts with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e, and a caller can supply identity values that another tenant also uses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with `return_skipped_upsert?: true`, and a caller can supply identity values that another tenant also uses."
}
],
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with return_skipped_upsert?: true, and a caller can supply identity values that another tenant also uses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:42.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAsh.bulk_create/4\u003c/code\u003e or a single create runs as an upsert with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e and the upsert is skipped (for example because its \u003ccode\u003eupsert_condition\u003c/code\u003e does not hold), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e reads the existing row back by the upsert identity in \u003ccode\u003edo_bulk_create/3\u003c/code\u003e and \u003ccode\u003eupsert/4\u003c/code\u003e. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using \u003ccode\u003estrategy :attribute\u003c/code\u003e it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 2.6.22 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen `Ash.bulk_create/4` or a single create runs as an upsert with `return_skipped_upsert?: true` and the upsert is skipped (for example because its `upsert_condition` does not hold), `AshPostgres.DataLayer` reads the existing row back by the upsert identity in `do_bulk_create/3` and `upsert/4`. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using `strategy :attribute` it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
],
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:48:43.829Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "`Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres returns another tenant\u0027s record for a skipped upsert",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w"
},
{
"name": "EEF CNA record for CVE-2026-115635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115635.html"
},
{
"name": "OSV record EEF-CVE-2026-115635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115635"
},
{
"name": "Introducing commit af0903f in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5"
},
{
"name": "Fix commit 8aa8122 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres returns another tenant\u0027s record for a skipped upsert when return_skipped_upsert? is set"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115635",
"datePublished": "2026-10-25T19:48:43.829Z",
"dateReserved": "2026-10-23T13:00:02.145Z",
"dateUpdated": "2026-10-26T14:35:21.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78699 (GCVE-0-2026-78699)
Vulnerability from cvelistv5
Published
2026-08-30 15:13
Modified
2026-09-01 12:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-252 - Unchecked Return Value
Summary
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data.
AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data.
This issue affects ash_postgres: from 0.25.0 before 2.13.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_postgres |
Version: 0.25.0 ≤ cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78699",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:30:06.722608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:30:30.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_postgres/security/advisories/GHSA-6fqq-j9c4-5766"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.MultiTenancy\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/multitenancy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.MultiTenancy\u0027:rename_tenant/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.13.0",
"status": "affected",
"version": "0.25.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.MultiTenancy\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/multitenancy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.MultiTenancy\u0027:rename_tenant/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8544ab15fe45784553c2d2da8ee1a388eee0174b",
"status": "affected",
"version": "03510dae24020e302558ef947be7ea874a9ce756",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a \u003ccode\u003emanage_tenant\u003c/code\u003e update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant\u0027s schema.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a `manage_tenant` update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant\u0027s schema."
}
],
"value": "An application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a manage_tenant update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant\u0027s schema."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.0",
"versionStartIncluding": "0.25.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant\u0027s schema to have their tenant record repointed at that other tenant\u0027s live schema, gaining access to its data.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPostgres.MultiTenancy.rename_tenant/3\u003c/code\u003e issues the \u003ccode\u003eALTER SCHEMA ... RENAME TO ...\u003c/code\u003e with the non-raising \u003ccode\u003eEcto.Adapters.SQL.query/2\u003c/code\u003e, discards its \u003ccode\u003e{:ok, _} | {:error, _}\u003c/code\u003e result, and unconditionally returns \u003ccode\u003e:ok\u003c/code\u003e. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling \u003ccode\u003emanage_tenant\u003c/code\u003e update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant\u0027s data.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 0.25.0 before 2.13.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant\u0027s schema to have their tenant record repointed at that other tenant\u0027s live schema, gaining access to its data.\n\n`AshPostgres.MultiTenancy.rename_tenant/3` issues the `ALTER SCHEMA ... RENAME TO ...` with the non-raising `Ecto.Adapters.SQL.query/2`, discards its `{:ok, _} | {:error, _}` result, and unconditionally returns `:ok`. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling `manage_tenant` update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant\u0027s data.\n\nThis issue affects ash_postgres: from 0.25.0 before 2.13.0."
}
],
"value": "Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant\u0027s schema to have their tenant record repointed at that other tenant\u0027s live schema, gaining access to its data.\n\nAshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant\u0027s data.\n\nThis issue affects ash_postgres: from 0.25.0 before 2.13.0."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T15:13:23.875Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_postgres/security/advisories/GHSA-6fqq-j9c4-5766"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78699.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78699"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8544ab15fe45784553c2d2da8ee1a388eee0174b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78699",
"datePublished": "2026-08-30T15:13:23.875Z",
"dateReserved": "2026-08-30T06:00:01.261Z",
"dateUpdated": "2026-09-01T12:30:30.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-49756 (GCVE-0-2024-49756)
Vulnerability from cvelistv5
Published
2024-10-23 17:04
Modified
2024-10-24 13:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-552 - Files or Directories Accessible to External Parties
Summary
AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions (no changing fields), and would allow their hooks (side effects) to be performed when they should not have been. Note that this does not allow reading new data that the user should not have had access to, only triggering a side effect a user should not have been able to trigger.
To be vulnerable, an affected user must have an update action that is on a resource with no attributes containing an "update default" (updated_at timestamp, for example); can be performed atomically; does not have `require_atomic? false`; has at least one authorizer (typically `Ash.Policy.Authorizer`); and has at least one `change` (on the resource's `changes` block or in the action itself). This is where the side-effects would be performed when they should not have been.
This problem has been patched in `2.4.10` of `ash_postgres`. Several workarounds are available. Potentially affected users may determine that none of their actions are vulnerable using a script the maintainers provide in the GitHub Security Advisory, add `require_atomic? false` to any potentially affected update action, replace any usage of `Ash.update` with `Ash.bulk_update` for an affected action, and/or add an update timestamp to their action.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ash-project | ash_postgres |
Version: >= 2.0.0, < 2.4.10 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ash_framework:ashpostgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ashpostgres",
"vendor": "ash_framework",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.4.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49756",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T13:52:11.056367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T13:59:48.830Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ash_postgres",
"vendor": "ash-project",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.4.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on \"empty\" update actions (no changing fields), and would allow their hooks (side effects) to be performed when they should not have been. Note that this does not allow reading new data that the user should not have had access to, only triggering a side effect a user should not have been able to trigger.\n\nTo be vulnerable, an affected user must have an update action that is on a resource with no attributes containing an \"update default\" (updated_at timestamp, for example); can be performed atomically; does not have `require_atomic? false`; has at least one authorizer (typically `Ash.Policy.Authorizer`); and has at least one `change` (on the resource\u0027s `changes` block or in the action itself). This is where the side-effects would be performed when they should not have been.\n\nThis problem has been patched in `2.4.10` of `ash_postgres`. Several workarounds are available. Potentially affected users may determine that none of their actions are vulnerable using a script the maintainers provide in the GitHub Security Advisory, add `require_atomic? false` to any potentially affected update action, replace any usage of `Ash.update` with `Ash.bulk_update` for an affected action, and/or add an update timestamp to their action."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552: Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T17:04:50.037Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ash-project/ash_postgres/security/advisories/GHSA-hf59-7rwq-785m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ash-project/ash_postgres/security/advisories/GHSA-hf59-7rwq-785m"
},
{
"name": "https://github.com/ash-project/ash_postgres/commit/1228fcd851f29a68609e236f7d6a2622a4b5c4ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ash-project/ash_postgres/commit/1228fcd851f29a68609e236f7d6a2622a4b5c4ba"
},
{
"name": "https://elixirforum.com/t/empty-update-action-with-policies/66954",
"tags": [
"x_refsource_MISC"
],
"url": "https://elixirforum.com/t/empty-update-action-with-policies/66954"
},
{
"name": "https://gist.github.com/zachdaniel/e49166b765978c48dfaf998d06df436e",
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/zachdaniel/e49166b765978c48dfaf998d06df436e"
}
],
"source": {
"advisory": "GHSA-hf59-7rwq-785m",
"discovery": "UNKNOWN"
},
"title": "AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability."
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-49756",
"datePublished": "2024-10-23T17:04:50.037Z",
"dateReserved": "2024-10-18T13:43:23.454Z",
"dateUpdated": "2024-10-24T13:59:48.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}