CVE-2026-81318— Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
Quick assessment
Affected
ash-project ash_sql
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-project 中的 ash_sql 存在一个不正确的授权漏洞：在基于模式（schema）的多租户应用程序中，调用者可能会接收到来自其他租户行的聚合值。 当对去重（distinct）查询进行聚合计算时， 仅依据 （仅包含 元组）重建外层查询，而没有携带 或 。在采用 多租户策略时，这些 prefix 字段中保存着租户的 schema 信息。因此，重建后的外层查询会读取仓库（repo）的默认 schema，而内部的相关子查询仍读取租户的 schema，两者仅通过主键进行连接。结果，聚合结果以及基于无 pref
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81318
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.
When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.source alone, which is only the {table, schema} tuple and does not carry query.prefix or query.from.prefix. For strategy(:context) multitenancy those hold the tenant schema, so the rebuilt outer query reads the repo's default schema while the inner correlated subquery still reads the tenant schema, and the two are joined only on primary key. The aggregate, and any relationship join added off the prefix-less binding, is then computed against the wrong tenant's rows. The neighbouring limit and exists branches instead wrap the query with subquery/1, which preserves the prefix.
This issue affects ash_sql: from 0.1.0 before 0.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_sql | 0.1.0 ~ 0.7.1 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_sql | dd092ed273dec7bd2194352f24a39229fc8ae68b ~ 3d95478cc9e1d5bfaf6144fe9b9793f29e5ab889 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-81318
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81318
请登录查看更多情报信息。
Other References for CVE-2026-81318 (4)
-
https://github.com/ash-project/ash_sql/security/advisories/GHSA-ww8j-58rc-f8h3 vendor-advisory related
Same Patch Batch · ash-project · 2026-08-30 · 11 CVEs total
| CVE-2026-75847 | 5.9 MEDIUM | Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail |
| CVE-2026-77970 | 5.9 MEDIUM | Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions |
| CVE-2026-78038 | 5.9 MEDIUM | Job argument injection via :args overrides primary_key and tenant in AshOban |
| CVE-2026-78228 | 5.9 MEDIUM | Unbounded handle_error recursion enables denial of service in AshOban triggers |
| CVE-2026-77454 | 5.9 MEDIUM | exists/2 predicate silently dropped on limited relationships with a parent() filter in Ash |
| CVE-2026-77831 | 2.1 LOW | Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking |
| CVE-2026-77846 | 2.1 LOW | JSON path injection via unescaped get_path segments in AshSqlite |
| CVE-2026-78691 | 2.1 LOW | Unescaped backslash allows LIKE wildcard injection in AshSql string search |
| CVE-2026-80227 | 2.1 LOW | SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql |
| CVE-2026-81316 | 2.1 LOW | Same-named aggregates with differing filters are conflated in AshSql |
IV. Related Vulnerabilities
Same product: ash_sql
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-78691
Unescaped backslash allows LIKE wildcard injection in AshSql -
CVE-2026-80227
SQL string_trim removes only spaces, diverging from in-memor
Same vendor: ash-project
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-78691
Unescaped backslash allows LIKE wildcard injection in AshSql -
CVE-2026-80227
SQL string_trim removes only spaces, diverging from in-memor -
CVE-2026-78228
Unbounded handle_error recursion enables denial of service i
Same weakness: CWE-863
-
CVE-2026-82634
Frappe Framework Development Branch Incorrect Authorization -
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-82463
pac4j-core before 6.5.6 Authorization Bypass via Reversed Pr -
CVE-2026-62904
Microsoft Edge (Chromium-based) Information Disclosure Vulne
V. Comments for CVE-2026-81318
No comments yet