Incorrect Authorization in ash_postgres Affects Ash Project
CVE-2026-115627

6MEDIUM

Key Information:

Vendor

Ash-project

Status
Ash Postgres
Vendor
CVE Published:
25 October 2026

What is CVE-2026-115627?

An incorrect authorization vulnerability in the ash_postgres component of the Ash Project allows users to access destination records related to other tenants through improperly configured many-to-many relationships. This occurs when a lateral join query fails to apply the necessary tenant-based restrictions, allowing unintended access to records that should be isolated to their respective tenants. This issue arises from the way queries are constructed in lateral_join_query/3 and through_step_queries/4, bypassing the intended multitenancy enforcement.

Affected Version(s)

ash_postgres 0.38.0 < 2.15.2

ash_postgres 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 < 8c25c945c39a45299193fe70b09fc2fa2aacac7b

References

https://github.com/ash-project/ash/security/advisories/GH...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-115627.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-115627
related

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Will Townsend
Will Townsend
Zach Daniel / Ash Project
.