Authorization Bypass Vulnerability in Ash-Project's Software for Tenant Data

CVE-2026-96581

What is CVE-2026-96581?

A vulnerability in Ash allows users from one tenant to read, overwrite, and take over records of another tenant due to insufficient multitenancy controls. When an upsert action is performed using a primary key from another tenant, the system fails to enforce the necessary restrictions, allowing unauthorized alterations of tenant data. This issue arises because the default upsert mechanisms bypass essential read and update policies, creating significant security risks for multitenant environments.

References