CVE-2026-115627: ash_postgres 0.38.0 to before 2.15.2

Affected technology

ash_postgres · 0.38.0 to before 2.15.2
ash-project

ash_postgres · 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 to before 8c25c945c39a45299193fe70b09fc2fa2aacac7b
ash-project

Component: 'Elixir.AshPostgres.DataLayer'
Function: 'Elixir.AshPostgres.DataLayer':lateral_join_query/3, 'Elixir.AshPostgres.DataLayer':through_step_queries/4, 'Elixir.AshPostgres.DataLayer':run_query_with_lateral_join/4
File: lib/data_layer.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user can load destination records linked to a source record only through another tenant's join rows. Source advisory’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none.