Incorrect Authorization in ash_postgres Affects Multiple Tenants
CVE-2026-115635

6MEDIUM

Key Information:

Vendor

Ash-project

Status
Ash Postgres
Vendor
CVE Published:
25 October 2026

What is CVE-2026-115635?

An incorrect authorization vulnerability in ash_postgres allows users to access records belonging to other tenants. This occurs when the Ash.bulk_create function is used with return_skipped_upsert set to true, leading to a situation where, if an upsert is skipped, the existing row can be retrieved without applying the required multitenancy checks. Consequently, if two tenants share identical attribute values, a user may inadvertently gain visibility into data that should be restricted, potentially exposing sensitive information.

Affected Version(s)

ash_postgres 2.6.22 < 2.15.2

ash_postgres af0903f1380468bbe1b61fe65acb33772b5e24a5 < 8aa81220c401cae412d21078d11b3519ea25d3a9

References

https://github.com/ash-project/ash/security/advisories/GH...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-115635.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-115635
related

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Will Townsend
Will Townsend
Zach Daniel / Ash Project
.