CVE-2026-115635: ash_postgres 2.6.22 to before 2.15.2

Affected technology

ash_postgres · 2.6.22 to before 2.15.2
ash-project

ash_postgres · af0903f1380468bbe1b61fe65acb33772b5e24a5 to before 8aa81220c401cae412d21078d11b3519ea25d3a9
ash-project

Component: 'Elixir.AshPostgres.DataLayer'
Function: 'Elixir.AshPostgres.DataLayer':do_bulk_create/3, 'Elixir.AshPostgres.DataLayer':upsert/4, 'Elixir.AshPostgres.DataLayer':bulk_create/3
File: lib/data_layer.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user can read another tenant's record through a skipped upsert. Source advisory’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none.