ash_postgres
2.15.2
The PostgreSQL data layer for Ash Framework
Current section
4 Advisories
Jump to
Current section
4 Advisories
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-115627.html
- https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2
- https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5
- https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b
- https://hex.pm/packages/ash_postgres
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-115635.html
- https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w
- https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9
- https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5
- https://hex.pm/packages/ash_postgres
rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
Affected Versions
In AshPostgres, empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.
Affected Versions
References
- https://elixirforum.com/t/empty-update-action-with-policies/66954
- https://gist.github.com/zachdaniel/e49166b765978c48dfaf998d06df436e
- https://github.com/ash-project/ash_postgres
- https://github.com/ash-project/ash_postgres/commit/1228fcd851f29a68609e236f7d6a2622a4b5c4ba
- https://github.com/ash-project/ash_postgres/security/advisories/GHSA-hf59-7rwq-785m
- https://nvd.nist.gov/vuln/detail/CVE-2024-49756
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
this version
61 735
yesterday
4 807
last 7 days
47 168
all time
1 763 441