{"schema":"threatline.record/2","record":{"id":"CVE-2026-115635","aliases":["GHSA-36hg-wwp2-fg8w"],"summary":"AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set","details":"Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2.","categories":["Unclassified"],"product":"ash_postgres","vendor":"ash-project","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115635","source_modified_at":"2026-10-25T19:48:43.829Z","fetched_at":"2026-10-25T21:40:15.971031Z","product":"ash_postgres","vendor":"ash-project","versions":[{"lessThan":"2.15.2","status":"affected","version":"2.6.22","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115635","source_modified_at":"2026-10-25T19:48:43.829Z","fetched_at":"2026-10-25T21:40:15.971031Z","product":"ash_postgres","vendor":"ash-project","versions":[{"lessThan":"8aa81220c401cae412d21078d11b3519ea25d3a9","status":"affected","version":"af0903f1380468bbe1b61fe65acb33772b5e24a5","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115635","source_modified_at":"2026-10-25T19:48:43.829Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"name":"ash_postgres","ecosystem":null},"version":"2.15.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115635","source_modified_at":"2026-10-25T19:48:43.829Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"name":"ash_postgres","ecosystem":null},"version":"8aa81220c401cae412d21078d11b3519ea25d3a9","basis":"first unaffected version stated in the CVE record"}],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T19:48:43.829Z","modified_at":"2026-10-25T19:48:43.829Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115635","fetched_at":"2026-10-25T21:40:15.971031Z","source_modified_at":"2026-10-25T19:48:43.829Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w","tags":["vendor-advisory","related"]},{"source":"CVE List","url":"https://cna.erlef.org/cves/CVE-2026-115635.html","tags":["related"]},{"source":"CVE List","url":"https://osv.dev/vulnerability/EEF-CVE-2026-115635","tags":["related"]},{"source":"CVE List","url":"https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5","tags":["related"]},{"source":"CVE List","url":"https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-25T19:48:43.829Z","content_hash":"e50ab2102943e982005cb95a5bf74a299e55aabe358c359eb757d5c979aa7fda"}}