---
id: CVE-2026-115635
title: >-
  AshPostgres returns another tenant's record for a skipped upsert when
  return_skipped_upsert? is set
summary: >-
  Incorrect Authorization vulnerability in ash-project ash_postgres allows a
  user to read another tenant's record through a skipped upsert.


  When Ash.bulk_create/4 or a single create runs as an upsert with
  return_skipped_upsert?: true and …
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: ash-project
product: ash_postgres
affected:
  - ash_postgres >= 2.6.22 < 2.15.2
  - >-
    ash-project/ash_postgres >= af0903f1380468bbe1b61fe65acb33772b5e24a5 <
    8aa81220c401cae412d21078d11b3519ea25d3a9
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T19:48:43.829Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115635'
references:
  - url: 'https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w'
    label: >-
      `Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres
      returns another tenant's record for a skipped upsert
  - url: 'https://cna.erlef.org/cves/CVE-2026-115635.html'
    label: EEF CNA record for CVE-2026-115635
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-115635'
    label: OSV record EEF-CVE-2026-115635
  - url: >-
      https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5
    label: Introducing commit af0903f in ash-project/ash_postgres
  - url: >-
      https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9
    label: Fix commit 8aa8122 in ash-project/ash_postgres
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.762Z'
---

## Overview

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.

When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.

This issue affects ash_postgres: from 2.6.22 before 2.15.2.

## Affected

- `ash_postgres >= 2.6.22 < 2.15.2`
- `ash-project/ash_postgres >= af0903f1380468bbe1b61fe65acb33772b5e24a5 < 8aa81220c401cae412d21078d11b3519ea25d3a9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.