CVE-2026-115635

Name of the Vulnerable Software and Affected Versions ash postgres versions 2.6.22 through 2.15.1

Description An incorrect authorization issue exists where a user can read another tenant's record during a skipped upsert. This occurs when Ash.bulk create/4 or a single create operation is executed as an upsert with return skipped upsert?: true and the upsert is skipped, such as when the upsert condition is not met. In these cases, AshPostgres.DataLayer retrieves the existing row using the upsert identity within the do bulk create/3 and upsert/4 functions. Because this lookup fails to apply the resource's attribute multitenancy—a method of isolating data for different tenants using a specific attribute—it may return a row belonging to another tenant that shares the same identity values, exposing sensitive fields to the caller.

Recommendations Update ash postgres to version 2.15.2 or later.