CVE-2026-115627: AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Q: Which deployments are exposed to cross-tenant relationship results?

Deployments using ash_postgres versions from 0.38.0 before 2.15.2 are affected when the join resource, or resources along a through relationship path, use :attribute multitenancy. The affected relationship load must use a lateral join, such as one caused by a per-record limit or sort.

Q: What does an attacker need to trigger the issue?

The caller needs to be able to load a many_to_many or through relationship that is executed with a lateral join. Exploitation depends on the presence of relevant join rows belonging to other tenants; the returned destination records are those linked only through those other-tenant rows.

Q: Does this affect relationship loads that do not use lateral joins?

The described issue is limited to many_to_many and through relationship loads performed with a lateral join. The vulnerable code paths are lateral_join_query/3 and through_step_queries/4, where read actions are not run for the join resource or resources along the through path.

Q: What version resolves the issue?

Upgrade ash_postgres to version 2.15.2 or later. Versions beginning with 0.38.0 and earlier than 2.15.2 are affected.

Published Oct 25, 2026

Updated

Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to load destination records linked to a source record only through another tenant's join rows.

When a manytomany relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateraljoinquery/3 and throughstepqueries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.

This issue affects ashpostgres: from 0.38.0 before 2.15.2.

Affected Software

1 affected component

hex/ash_postgres>=0.38.0<2.15.2

Event History

Oct 25, 2026

CVE Published

via MITRE·07:49 PM

Data Sourced

via MITRE·07:49 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to cross-tenant relationship results?

Deployments using ash_postgres versions from 0.38.0 before 2.15.2 are affected when the join resource, or resources along a through relationship path, use :attribute multitenancy. The affected relationship load must use a lateral join, such as one caused by a per-record limit or sort.

What does an attacker need to trigger the issue?

The caller needs to be able to load a many_to_many or through relationship that is executed with a lateral join. Exploitation depends on the presence of relevant join rows belonging to other tenants; the returned destination records are those linked only through those other-tenant rows.

Does this affect relationship loads that do not use lateral joins?

The described issue is limited to many_to_many and through relationship loads performed with a lateral join. The vulnerable code paths are lateral_join_query/3 and through_step_queries/4, where read actions are not run for the join resource or resources along the through path.

What version resolves the issue?

Upgrade ash_postgres to version 2.15.2 or later. Versions beginning with 0.38.0 and earlier than 2.15.2 are affected.

CVE-2026-115627: AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to cross-tenant relationship results?

What does an attacker need to trigger the issue?

Does this affect relationship loads that do not use lateral joins?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to cross-tenant relationship results?

What does an attacker need to trigger the issue?

Does this affect relationship loads that do not use lateral joins?

What version resolves the issue?