PT-2026-123118

Incorrect Authorization vulnerability in ash-project ash postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many to many relationship, or a through relationship, is loaded with a lateral join for example with a per-record...

PT-2026-123119

Incorrect Authorization vulnerability in ash-project ash postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk create/4 or a single create runs as an upsert with return skipped upsert?: true and the upsert is skipped for example because its upsert conditio...

PT-2026-83585

Summary Unchecked Return Value vulnerability in ash-project ash postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

Ash Postgres Code Execution

The vulnerability of the extension for using the PostgreSQL database, Ash Postgres framework, is related to the use of files and directories accessible to external parties. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by replacing the installation files...