Riskcovery

CVE-2026-115627

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

State
Published
Severity
6.0 Medium
Published
Oct 25, 2026
Updated
Oct 26, 2026
Reserved
Oct 23, 2026

Read the record on cve.org

Description

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.

When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.

This issue affects ash_postgres: from 0.38.0 before 2.15.2.

Scores

CVSSScoreVectorSource
4.06.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

Affected Products

ProductVersions
ash_postgresash-project
  • 0.38.0 to before 2.15.2Affected
ash_postgresash-project
  • 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 to before 8c25c945c39a45299193fe70b09fc2fa2aacac7bAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.