---
id: CVE-2026-115627
title: >-
  AshPostgres ignores attribute multitenancy on the join resource when loading
  many_to_many and through relationships, returning records related through
  other tenants' rows
summary: >-
  Incorrect Authorization vulnerability in ash-project ash_postgres allows a
  user to load destination records linked to a source record only through
  another tenant's join rows.


  When a many_to_many relationship, or a through relationship, …
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: ash-project
product: ash_postgres
affected:
  - ash_postgres >= 0.38.0 < 2.15.2
  - >-
    ash-project/ash_postgres >= 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 <
    8c25c945c39a45299193fe70b09fc2fa2aacac7b
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T19:49:50.510Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115627'
references:
  - url: 'https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2'
    label: >-
      AshPostgres ignores attribute multitenancy on the join resource when
      loading `many_to_many` and `through` relationships, returning records
      related through other tenants' rows
  - url: 'https://cna.erlef.org/cves/CVE-2026-115627.html'
    label: EEF CNA record for CVE-2026-115627
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-115627'
    label: OSV record EEF-CVE-2026-115627
  - url: >-
      https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5
    label: Introducing commit 7115bec in ash-project/ash_postgres
  - url: >-
      https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b
    label: Fix commit 8c25c94 in ash-project/ash_postgres
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.761Z'
---

## Overview

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.

When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.

This issue affects ash_postgres: from 0.38.0 before 2.15.2.

## Affected

- `ash_postgres >= 0.38.0 < 2.15.2`
- `ash-project/ash_postgres >= 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 < 8c25c945c39a45299193fe70b09fc2fa2aacac7b`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.