AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.15.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
AshPostgres, a data layer library for the Ash Elixir framework, is affected: when a skipped upsert returns the existing record, it could return another tenant's data to the caller on resources using attribute multitenancy. This lets a user read records belonging to other tenants, exposing their fields without authorization.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- ash_postgres
From 2.6.22 · fixed in 2.15.2
- ash-project/ash_postgres
From af0903f1380468bbe1b61fe65acb33772b5e24a5 · fixed in 8aa81220c401cae412d21078d11b3519ea25d3a9
- ash_postgresHex
From 2.6.22 · fixed in 2.15.2