ash-project ash postgres vulnerabilities

Latest ash-project ash postgres CVEs

Newest publication first

1. CVE-2026-115627 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

   Published 2026-10-25

   Medium·CVSS 6.0 EPSS 0.25%

   Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example w...

2. CVE-2026-115635 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

   Published 2026-10-25

   Medium·CVSS 6.0 EPSS 0.25%

   Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because i...

3. CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

   Published 2026-08-30

   High·CVSS 7.2 EPSS 0.16%

   Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data. AshPostgres....

4. CVE-2024-49756 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

   Published 2024-10-23

   Medium·CVSS 5.3 EPSS 0.51%

   AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions (no changing fi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.