CVE-2026-115635
Received Received - Intake

Incorrect Authorization in Ash Postgres via Skipped Upsert

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115635
EUVD
EUVD-2026-109568

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash_postgres 2.6.22
ash-project ash_postgres af0903f1380468bbe1b61fe65acb33772b5e24a5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in the ash_postgres library. It occurs when using Ash.bulk_create/4 or a single create operation as an upsert with return_skipped_upsert?: true. If the upsert is skipped, the system retrieves an existing row by the upsert identity without applying the resource's attribute multitenancy. This can expose another tenant's record with the same identity values to the caller.

Impact Analysis

This vulnerability allows a user to read another tenant's record when the resource uses attribute multitenancy and the upsert is skipped. It could lead to unauthorized data exposure, violating data isolation between tenants. The impact is limited to resources using the :attribute multitenancy strategy.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data isolation between tenants, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized data exposure risks non-compliance and potential legal consequences.

Mitigation Strategies

Update ash_postgres to version 2.15.2 or later to address the incorrect authorization issue in skipped upsert operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart