AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.15.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
AshPostgres, the PostgreSQL data layer for the Elixir Ash framework, is affected. When many-to-many or through relationships are loaded with certain query options, it can return records linked only through join rows belonging to other tenants, exposing data across tenant boundaries in multitenant applications.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- ash_postgres
From 0.38.0 · fixed in 2.15.2
- ash-project/ash_postgres
From 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 · fixed in 8c25c945c39a45299193fe70b09fc2fa2aacac7b
- ash_postgresHex
From 0.38.0 · fixed in 2.15.2