PT-2026-83585 · Unknown · Ashpostgres
CVSS v4.0
7.2
High
| Vector | AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash postgres versions 0.25.0 through 2.12.9
Description
An unchecked return value in the
rename tenant/3 function within AshPostgres.MultiTenancy allows a user to rename a tenant to a name that conflicts with an existing tenant's schema. The function uses Ecto.Adapters.SQL.query/2 to execute an ALTER SCHEMA command but discards the result, unconditionally returning :ok even if PostgreSQL rejects the rename due to a schema collision, insufficient privileges, or lock timeouts. Consequently, the system commits the tenant record with the new name, repointing it to another tenant's live schema and granting unauthorized access to that tenant's data during subsequent read and write operations.Recommendations
Update ash postgres to version 2.13.0 or later.
Exploit
Fix
Unchecked Return Value
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ashpostgres