CVE-2026-115635: AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-25 · updated 2026-10-26
Weakness: CWE-863

Description

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.

Affected products

ash-project ash_postgres: from 2.6.22 before 2.15.2 — fixed in 2.15.2

How to fix

Upgrade to a fixed version: ash-project ash_postgres 2.15.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-115635 or the next vulnerability affects your stack