{"answers":{"affected":"1 open source package ship an affected version, including ash_postgres.","exploited":"There is no known exploitation of CVE-2026-115635 in the wild and no public exploit code.","fix":"Upgrade ash_postgres to 2.15.2 or later.","what":"CVE-2026-115635 is a medium-severity vulnerability in ash-project ash_postgres, published on 25 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-115635 and fix it if it is affected.\n\nWhat it is: CVE-2026-115635 is a medium-severity vulnerability in ash-project ash_postgres, published on 25 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-115635 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ash_postgres (Hex): affected from 2.6.22; fixed in 2.15.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-115635/ (Markdown: https://insights.sbomify.com/CVE-2026-115635/index.md)","id":"CVE-2026-115635","markdown":"https://insights.sbomify.com/CVE-2026-115635/index.md","name":"CVE-2026-115635","record":{"aliases":["EEF-CVE-2026-115635","GHSA-36hg-wwp2-fg8w"],"analysis":null,"analysis_generated_by":null,"assigner":"EEF","cpe":[],"cvss":{"score":6,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set","id":"CVE-2026-115635","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":5,"next":{"headline":"OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.","id":"CVE-2026-115638"},"packages":[{"ecosystem":"Hex","fixed":["2.15.2"],"introduced":["2.6.22"],"last_affected":[],"package":"ash_postgres","purl":"pkg:hex/ash_postgres","source":"EEF-CVE-2026-115635"}],"prev":{"headline":"Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only t","id":"CVE-2026-115627"},"products":["ash_postgres"],"published":"2026-10-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-26","vendors":["ash-project"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-115635/"}