← Back to the live CVE advisory feed

CVE-2026-115635: ash_postgres

Severity

6 (MEDIUM)

Vendor

ASH-PROJECT

Affected versions

2.6.22 through before 2.15.2; af0903f1380468bbe1b61fe65acb33772b5e24a5 through before 8aa81220c401cae412d21078d11b3519ea

Fixed version

2.15.2.

Patch status

Patched

Published

2026-10-25T20:16:32.293

Modified

2026-10-25T20:16:32.293

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.

View the official NVD record for CVE-2026-115635

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.