CVE-2026-115627
Received Received - Intake

Incorrect Authorization in ash_postgres via Lateral Join Queries

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115627
EUVD
EUVD-2026-109569

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash_postgres 0.38.0
ash-project ash_postgres 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in ash_postgres where multitenancy checks are bypassed when loading many_to_many or through relationships with lateral joins. The system fails to apply tenant isolation for join resources or intermediate resources in a through path, allowing users to access records linked through other tenants' join rows.

Impact Analysis

Unauthorized users may access sensitive data belonging to other tenants due to bypassed tenant isolation. This could lead to data leaks, privacy violations, or unauthorized access to confidential information. Exploitation requires low privileges and network access but no user interaction.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data privacy) by allowing unauthorized access to tenant-specific data. It undermines tenant isolation, a key requirement for regulatory compliance in multi-tenant systems.

Mitigation Strategies
  • Update ash_postgres to version 2.15.2 or later to patch the vulnerability.
  • Review all many_to_many and through relationships in your application that use lateral joins with attribute multitenancy enabled.
  • Audit queries involving lateral joins to ensure tenant isolation is enforced correctly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart