ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115635

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Published Oct 25, 2026 · catalog updated Oct 25, 2026 · AshPostgres returns another tenant's

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115635. EPSS is 0.25%. Act only if a listed version of AshPostgres returns another tenant's is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (AshPostgres returns another tenant's).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.25%
Remediation
Advisory link
Affected products
Hex ash_postgres · vendor ash-project ash_postgres

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When or a single create runs as an upsert with and the upsert is skipped (for example because its does not hold), reads the existing row back by the upsert identity in and . That lookup did not apply the resource's attribute multitenancy, so on a resource using it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2. ## Impact A user of one tenant whose upsert is skipped receives another tenant's record with the same identity values. ## Configurations Reachable when a resource uses attribute multitenancy, an action performs upserts with , and a caller can supply identity values that another tenant also uses.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex ash_postgres2.6.22 → 2.15.2
  • vendor ash-project ash_postgresversion unspecified

How to fix CVE-2026-115635

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115635. EPSS is 0.25%. Act only if a listed version of AshPostgres returns another tenant's is installed.

Which versions are affected?

Compare what you have installed with 2.6.22 → 2.15.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.25%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

PostgreSQL security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 25, 2026 · GitHub Advisory Database

    Detected

    ## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When or a single create runs as an upsert with and the upsert is skipped (for example because its does not hold), reads the existing row back by the upsert identity in and . That lookup did not apply the resource's attribute multitenancy, so on a reso

  2. Oct 25, 2026 · GitHub Advisory Database

    Fix available

    ash_postgres fixed in 2.15.2

  3. Oct 25, 2026 · GitHub Advisory Database

    Fix available

    ash_postgres fixed in 2.15.2

  4. Oct 25, 2026 · GitHub Advisory Database

    Updated

    ## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When or a single create runs as an upsert with and the upsert is skipped (for example because its does not hold), reads the existing row back by the upsert identity in and . That lookup did not apply the resource's attribute multitenancy, so on a reso

Sources

  • CVE.orgVulnerability recordCVE-2026-115635

    Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because i

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-115635

    30-day exploitation probability 0.25%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-36hg-wwp2-fg8w

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-115635

    AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

    osv.dev

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 4, 2026
  • GitHub Advisory DatabaseOct 26, 2026
  • OpenSSF OSV / OSV ScannerOct 26, 2026
  • CVE.orgOct 26, 2026