Vulnerability · Published Oct 25, 2026 · Assigned by EEF

CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Medium 6.0

In plain English

A medium-severity incorrect authorization in ash_postgres from ash-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.

Affected products (as reported)

Vendor	Product	Versions
ash-project	ash_postgres	2.6.22 – before 2.15.2
ash-project	ash_postgres	af0903f1380468bbe1b61fe65acb33772b5e24a5 – before 8aa81220c401cae412d21078d11b3519ea25d3a9

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

`Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres returns another tenant's record for a skipped upsert vendor-advisory, related
EEF CNA record for CVE-2026-115635 related
OSV record EEF-CVE-2026-115635 related
Introducing commit af0903f in ash-project/ash_postgres related
Fix commit 8aa8122 in ash-project/ash_postgres patch