CVE-2026-81318: Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.
When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer query from query.from.source alone, which is only the {table, schema} tuple and does not carry query.prefix or query.from.prefix. For strategy(:context) multitenancy those hold the tenant schema, so the rebuilt outer query reads the repo's default schema while the inner correlated subquery still reads the tenant schema, and the two are joined only on primary key. The aggregate, and any relationship join added off the prefix-less binding, is then computed against the wrong tenant's rows. The neighbouring limit and exists branches instead wrap the query with subquery/1, which preserves the prefix.
This issue affects ashsql: from 0.1.0 before 0.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_sqlto a version that resolves this vulnerability.Fixed in 0.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using ash_sql versions from 0.1.0 before 0.7.1 are affected when they use schema-based multitenancy with strategy(:context) and compute aggregates over distinct queries. The issue concerns tenant schema prefixes carried in query.prefix or query.from.prefix.
What conditions are required for data from another tenant to be returned?
A caller must trigger an aggregate computed over a distinct query in an affected schema-based multitenant application. The rebuilt outer query can then read the repository default schema while the correlated subquery reads the tenant schema, with rows joined only by primary key.
Are all aggregate query paths affected?
No. The described issue is specific to the distinct-query aggregate path in AshSql.AggregateQuery.add_single_aggs/5. The neighboring limit and exists branches use subquery/1, which preserves the tenant prefix.
What version resolves the issue?
Upgrade ash_sql to version 0.7.1 or later. Versions before 0.7.1, starting with 0.1.0, are identified as affected.