Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115627— AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Quick assessment

Affected

ash-project ash_postgres

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中存在一个授权不当（Incorrect Authorization）漏洞。该漏洞允许用户通过其他租户的连接行（join rows），加载仅与源记录间接关联的目标记录。具体而言，当使用横向连接（lateral join）加载多对多关系或“通过”（through）关系时（例如在需要逐条记录限制或排序的场景中），会在和函数中为连接资源及“通过”路径上的每个资源构建查询，但并未执行这些资源对应的读取操作（read action）。而属性级多租户（attribute multitenancy）的过滤逻辑正是在读取操作

CVSS 6.0 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1548 · Abuse Elevation Control Mechanism T1201 · Password Policy Discovery

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ash-project	ash_postgres	`0.38.0< 2.15.2`	affected
		`7115bec58678f13b1ac2fb4822a0ba1aea9dbec5< 8c25c945c39a45299193fe70b09fc2fa2aacac7b`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Source: CVE Program / CVE List V5

Vulnerability Description

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ash-project	ash_postgres	0.38.0 ~ 2.15.2	`cpe:2.3:a:ash-project:ash_postgres::::::::`
ash-project	ash_postgres	7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 ~ 8c25c945c39a45299193fe70b09fc2fa2aacac7b	`cpe:2.3:a:ash-project:ash_postgres::::::::`

II. Public POCs for CVE-2026-115627

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115627

请登录查看更多情报信息。

Other References for CVE-2026-115627 (5)

https://www.cve.org/CVERecord?id=CVE-2026-115627

Same Patch Batch · ash-project · 2026-10-25 · 3 CVEs total

CVE-2026-114214	6.0 MEDIUM	Loading a through relationship with a limit of 1 in Ash ignores the through path and retur
CVE-2026-115635	6.0 MEDIUM	AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upser

IV. Related Vulnerabilities

Same product: ash_postgres

Same vendor: ash-project

Same weakness: CWE-863