CVE-2026-115635 Details
Description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.
A vulnerability in the Ash-Project Ash_Postgres library, specifically in versions 2.6.22 prior to 2.15.2, allows users to access records from other tenants through a flawed upsert process. When the 'return_skipped_upsert?' option is enabled and an upsert is bypassed due to unmet conditions, the data layer retrieves the existing record using the upsert identity. This retrieval process fails to consider the resource's attribute multitenancy, potentially exposing fields from another tenant with matching identity values on resources using attribute-based multitenancy.
Users can upgrade to Ash_Postgres version 2.15.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-115635.html | EEF | AdvisoryBundle |
| https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5 | EEF | Source CodeVendor |
| https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-115635 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | EEF |
Affected Products
| Product | Versions |
|---|---|
| AshPostgres | >= 2.6.22, < 2.15.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | EEF |