CVE-2026-81318
Received Received - Intake

Incorrect Authorization in Ash SQL Allows Tenant Data Leakage

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.source alone, which is only the {table, schema} tuple and does not carry query.prefix or query.from.prefix. For strategy(:context) multitenancy those hold the tenant schema, so the rebuilt outer query reads the repo's default schema while the inner correlated subquery still reads the tenant schema, and the two are joined only on primary key. The aggregate, and any relationship join added off the prefix-less binding, is then computed against the wrong tenant's rows. The neighbouring limit and exists branches instead wrap the query with subquery/1, which preserves the prefix. This issue affects ash_sql: from 0.1.0 before 0.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81318
EUVD
EUVD-2026-68189

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_sql From 0.1.0 (inc) to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in the ash-project ash_sql library affecting versions 0.1.0 to 0.7.0. It occurs in schema-based multitenant applications using strategy(:context) multitenancy when computing aggregates over distinct queries. The AshSql.AggregateQuery.add_single_aggs/5 function rebuilds the outer query without preserving the tenant schema prefix, causing aggregates to be computed from another tenant's rows instead of the intended tenant.

Detection Guidance

To detect this vulnerability, check if your application uses ash_sql versions 0.1.0 to 0.7.0 with schema-based multitenancy using strategy(:context). Review code for aggregate computations over distinct queries, particularly those filtering across to-many relationships. Look for incorrect data aggregation results that may indicate cross-tenant data exposure.

Impact Analysis

This vulnerability can lead to cross-tenant information disclosure where an attacker in one tenant could access aggregate values (sums, counts, averages) computed from another tenant's data. This could expose sensitive information across tenants in a multitenant application.

Compliance Impact

This vulnerability could violate compliance requirements for data isolation and tenant separation in GDPR and HIPAA. It may lead to unauthorized access to sensitive data across tenants, potentially resulting in regulatory penalties for failing to maintain proper data segregation.

Mitigation Strategies

Immediately upgrade ash_sql to version 0.7.1 or later. If upgrading is not possible, review all aggregate queries in your application, especially those over distinct queries with multitenancy. Ensure tenant schema prefixes are preserved in all query operations. Consider temporarily disabling aggregate computations over distinct queries until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart