{"answers":{"affected":"1 open source package ship an affected version, including ash_sql.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81318 exists.","fix":"Upgrade ash_sql to 0.7.1 or later.","what":"CVE-2026-81318 is a low-severity missing authorization vulnerability in ash-project ash_sql, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-81318 and fix it if it is affected.\n\nWhat it is: CVE-2026-81318 is a low-severity missing authorization vulnerability in ash-project ash_sql, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81318 exists.\n\nAffected packages and fixed versions:\n- ash_sql (Hex): affected from 0.1.0; fixed in 0.7.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-81318/ (Markdown: https://insights.sbomify.com/CVE-2026-81318/index.md)","id":"CVE-2026-81318","markdown":"https://insights.sbomify.com/CVE-2026-81318/index.md","name":"CVE-2026-81318","record":{"aliases":["EEF-CVE-2026-81318","GHSA-ww8j-58rc-f8h3"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Elixir SQL library","requires_auth":"none","summary":"Attackers can read aggregate data from other tenants in AshSql applications using distinct queries due to missing schema prefixes.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":2.1,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.\n\nWhen an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.source alone, which is only the {table, schema} tuple and does not carry query.prefix or query.from.prefix. For strategy(:context) multitenancy those hold the tenant schema, so the rebuilt outer query reads the repo's default schema while the inner correlated subquery still reads the tenant schema, and the two are joined only on primary key. The aggregate, and any relationship join added off the prefix-less binding, is then computed against the wrong tenant's rows. The neighbouring limit and exists branches instead wrap the query with subquery/1, which preserves the prefix.\n\nThis issue affects ash_sql: from 0.1.0 before 0.7.1.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql","id":"CVE-2026-81318","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"Unsafe deserialization of decrypted terms enables node DoS in AshCloak","id":"CVE-2026-81319"},"packages":[{"ecosystem":"Hex","fixed":["0.7.1"],"introduced":["0.1.0"],"last_affected":[],"package":"ash_sql","purl":"pkg:hex/ash_sql","source":"EEF-CVE-2026-81318"}],"prev":{"headline":"Same-named aggregates with differing filters are conflated in AshSql","id":"CVE-2026-81316"},"products":["ash_sql"],"published":"2026-08-30","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-31","vendors":["ash-project"]},"summary":"Attackers can read aggregate data from other tenants in AshSql applications using distinct queries due to missing schema prefixes.","url":"https://insights.sbomify.com/CVE-2026-81318/"}