ash-project ash_postgres

• CVE-2026-115627 Medium 6.0 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows 0.2%
• CVE-2026-115635 Medium 6.0 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set 0.2%
• CVE-2026-78699 High 7.2 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres 0.2%
• CVE-2024-49756 Medium 5.3 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. 0.5%