CVE-2026-81318

Name of the Vulnerable Software and Affected Versions ash sql versions 0.1.0 through 0.7.0

Description An incorrect authorization issue exists in schema-based multitenant applications. When an aggregate is computed over a distinct query, the function add single aggs() rebuilds the outer query using only the source tuple, omitting the query.prefix or query.from.prefix. In applications using the strategy(:context) multitenancy approach, these prefixes contain the tenant schema. Consequently, the rebuilt outer query accesses the default repository schema while the inner correlated subquery accesses the tenant schema, leading to aggregate values being computed from rows belonging to a different tenant.

Recommendations Update ash sql to version 0.7.1 or later.