CVE-2026-115627 Details
Description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2.
A vulnerability allowing incorrect authorization has been identified in the Ash-Project's Ash_Postgres library, specifically in versions 0.38.0 prior to 2.15.2. This vulnerability arises when loading 'many_to_many' or 'through' relationships that involve multiple tenants. The issue occurs because the library's data layer does not properly apply attribute-based multitenancy to join resources, allowing users to access destination records linked through another tenant's join rows. This flaw is particularly problematic when relationships are loaded with lateral joins that include per-record limits or sorting, as it can result in unauthorized access to data from other tenants.
Users can upgrade to Ash_Postgres version 2.15.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-115627.html | EEF | Advisory |
| https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b | EEF | Source CodeVendor |
| https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-115627 | EEF | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | EEF |
Affected Products
| Product | Versions |
|---|---|
| AshPostgres | >= 0.38.0, < 2.15.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | EEF |