ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115627

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Published Oct 25, 2026 · catalog updated Oct 25, 2026 · AshPostgres ignores attribute multitenancy

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115627. EPSS is 0.25%. Act only if a listed version of AshPostgres ignores attribute multitenancy is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (AshPostgres ignores attribute multitenancy).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.25%
Remediation
Advisory link
Affected products
Hex ash_postgres · vendor ash-project ash_postgres

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a relationship, or a relationship, is loaded with a lateral join (for example with a per-record limit or sort), builds the query for the join resource, and for each resource along a path, in and without running that resource's read action, which is where attribute multitenancy is applied. When those resources use multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2. ## Impact A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant's join rows. ## Configurations Reachable when the join resource of a relationship, or a resource along a path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex ash_postgres0.38.0 → 2.15.2
  • vendor ash-project ash_postgresversion unspecified

How to fix CVE-2026-115627

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115627. EPSS is 0.25%. Act only if a listed version of AshPostgres ignores attribute multitenancy is installed.

Which versions are affected?

Compare what you have installed with 0.38.0 → 2.15.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.25%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

PostgreSQL security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 25, 2026 · GitHub Advisory Database

    Detected

    ## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a relationship, or a relationship, is loaded with a lateral join (for example with a per-record limit or sort), builds the query for the join resource, and for each resource along a path, in and without runnin

  2. Oct 25, 2026 · GitHub Advisory Database

    Fix available

    ash_postgres fixed in 2.15.2

  3. Oct 25, 2026 · GitHub Advisory Database

    Fix available

    ash_postgres fixed in 2.15.2

  4. Oct 25, 2026 · GitHub Advisory Database

    Updated

    ## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a relationship, or a relationship, is loaded with a lateral join (for example with a per-record limit or sort), builds the query for the join resource, and for each resource along a path, in and without runnin

Sources

  • CVE.orgVulnerability recordCVE-2026-115627

    Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example w

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-115627

    30-day exploitation probability 0.25%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-gr2r-f49c-9gm2

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-115627

    AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

    osv.dev

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • GitHub Advisory DatabaseOct 26, 2026
  • OpenSSF OSV / OSV ScannerOct 26, 2026
  • CVE.orgOct 26, 2026