ash_postgres vulnerabilities
CVEs whose affected-version data names the ash_postgres package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115635Medium· 6.0AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and …
▾ Sunlitash-project · ash_postgresvia CVEORG
CVE-2026-115627Medium· 6.0AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, …
▾ Sunlitash-project · ash_postgresvia CVEORG