Technical impact
The flaw occurs because AshPostgres ignores the multitenancy attribute when building join queries for many_to_many and through relationships. As a result, the lateral join can include rows from other tenants, and a user can request a relationship load that returns records belonging to unrelated tenants. This leads to an unauthorized disclosure of tenant data, violating confidentiality and potentially enabling further exploitation.
Affected Systems
The affected product is AshPostgres from the ash‑project repository. Versions from 0.38.0 up to and including 2.15.1 are vulnerable. Newer releases of 2.15.2 and later incorporate the fix, so only installations of these earlier versions should be considered at risk.
Risk and Exploitability
The CVSS base score is 6.0, indicating a medium severity impact assuming an attacker can read the sensitive records. The EPSS is not available, so the likelihood of exploitation in the wild cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The probable attack vector is a remote request made through the application’s API or interface that triggers a many_to_many or through load, which is assumed given how AshPostgres performs lateral joins when such requests are processed. The vulnerability requires that the user have permission to read records for their own tenant; it is therefore not a privilege escalation attack but reveals data that should have been inaccessible.
