EEF-CVE-2026-78699 CVE-2026-78699 GHSA-6fqq-j9c4-5766
rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.16%
- Chance of exploitation in the next 30 days. Higher than 5.20% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-252 Unchecked Return Value
- Fix
2.13.0- Upgrade ash_postgres to this version or later
Description
Summary
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data.
AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data.
This issue affects ash_postgres: from 0.25.0 before 2.13.0.
Configurations
An application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a manage_tenant update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant's schema.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_postgres | >= 0.25.0, < 2.13.0 |
2.13.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_postgres Hex → 2.13.0
- mix
{:ash_postgres, "~> 2.13.0"} # then: mix deps.update ash_postgres
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How to prevent it
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Implementation: Ensure that you account for all possible return values from the function.
- Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-115627 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | Not rated yet | Also affects ash_postgres |
| EEF-CVE-2026-115635 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | Not rated yet | Also affects ash_postgres |
| GHSA-hf59-7rwq-785m In AshPostgres, empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. | Medium | Also affects ash_postgres |
| GHSA-9v8h-qqgm-4m35 Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package | Critical Known exploited | Same weakness, CWE-252 |
| GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol | High | Same weakness, CWE-252 |
| GHSA-9mr8-pwpw-3j2w Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability | High | Same weakness, CWE-252 |
| GHSA-qh5g-q395-cx4j ImageMagick: Heap-use-after-free via XMP profile could result in a crash | Medium | Same weakness, CWE-252 |
| GHSA-jcqp-6r6f-3mfx ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression | Medium | Same weakness, CWE-252 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor