CVE-2026-115627mediumCWE-863

CVE-2026-115627: falha de média gravidade em ash-project ash_postgres

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ash postgres+ Monitorar ash_postgres

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 0.2%
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ash-project · ash_postgres
CVEs relacionadas — ash-project ash_postgres

No mesmo produto, das mais perigosas para as menos.

CVE-2024-49756MEDIUMAshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.EPSS 0.5%CVE-2026-115635MEDIUMAshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setEPSS 0.2%CVE-2026-78699HIGHrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresEPSS 0.2%