CVE-2026-115635

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Published Oct 25, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.

When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.

This issue affects ash_postgres: from 2.6.22 before 2.15.2.

Analysis

Technical impact

AshPostgres exposes an incorrect authorization flaw that allows a legitimate user to read records belonging to another tenant when using the upsert feature with the return_skipped_upsert? option enabled. Because the lookup that retrieves the existing row for a skipped upsert does not apply the resource's attribute-based multitenancy setting, an upsert that is skipped on the calling tenant can cause the database to return data owned by a different tenant. This leads to unauthorized disclosure of sensitive information and is identified as CWE‑863.

Affected Systems

The issue affects the ash-project's AshPostgres library. All versions starting with 2.6.22 up through (but excluding) 2.15.2 are vulnerable. Deployments of ash_postgres that rely on the upsert functionality with return_skipped_upsert? set to true are at risk.

Risk and Exploitability

The vulnerability has a CVSS score of 6, indicating medium severity. No EPSS score is currently available, and it is not listed in CISA's KEV catalog. The likely attack vector would be via the application’s API or service layer that accepts upsert requests; an attacker with a valid user context can manipulate the request to trigger the vulnerable path. Although the exploitation does not require elevated privileges beyond a typical application user, the ability to read another tenant’s data could be valuable, especially in multi‑tenant environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ash-project

ash_postgres

unaffected

Version	Status	Constraints
`2.6.22`	affected	< 2.15.2

ash-project

ash_postgres

unaffected

Version	Status	Constraints
`af0903f1380468bbe1b61fe65acb33772b5e24a5`	affected	< 8aa81220c401cae412d21078d11b3519ea25d3a9

No data.

Vendor Product Versions

Ash-project

Ash Postgres

Version	Status	Scheme	Platform
`[2.6.22,2.15.2)`	affected	semver	—

Ash-project

Ash Postgres

Version	Status	Scheme	Platform
`[af0903f1380468bbe1b61fe65acb33772b5e24a5,8aa81220c401cae412d21078d11b3519ea25d3a9)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the AshPostgres library to a fixed version, 2.15.2 or later, which corrects the missing multitenancy enforcement for skipped upserts.
Review and remove usage of the return_skipped_upsert? option unless absolutely required, and verify that attribute-based multitenancy is enforced before any data is returned.
If an immediate upgrade is not possible, restrict the ability to perform upserts with skip logic to trusted users or roles and monitor for anomalous skipped upsert activity.

Generated by OpenCVE AI on October 25, 2026 at 21:30 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.246% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-115635.html
https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w
https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9
https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5
https://osv.dev/vulnerability/EEF-CVE-2026-115635

History

Oct 26, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Title		AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
First Time appeared		Ash-project Ash-project ash Postgres
Weaknesses		CWE-863
CPEs		cpe:2.3:a:ash-project:ash_postgres::::::::
Vendors & Products		Ash-project Ash-project ash Postgres
References		https://cna.erlef.org/cves/CVE-2026-115635.html https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9 https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5 https://osv.dev/vulnerability/EEF-CVE-2026-115635
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`