CVE-2026-115627

The ash_postgres component (versions 0.38.0 before 2.15.2 ) is vulnerable to an Incorrect Authorization issue (CWE-863). When loading many_to_many or through relationships using a lateral join (such as with sorting or per-record limits), the AshPostgres.DataLayer fails to execute the resource's r...

EEF-CVE-2026-115635 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Summary Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulkcreate/4 or a single create runs as an upsert with returnskippedupsert?: true and the upsert is skipped for example because its...