ash-project ash_postgres prior 2.13.0 MultiTenancy AshPostgres.MultiTenancy.rename_tenant return value

Summaryinfo

A vulnerability was found in ash-project ash_postgres. It has been classified as problematic. Impacted is the function AshPostgres.MultiTenancy.rename_tenant of the component MultiTenancy. This manipulation causes return value. This vulnerability is handled as CVE-2026-78699. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in ash-project ash_postgres. Affected by this vulnerability is the function AshPostgres.MultiTenancy.rename_tenant of the component MultiTenancy. The manipulation with an unknown input leads to a return value vulnerability. The CWE definition for the vulnerability is CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data. AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data. This issue affects ash_postgres: from 0.25.0 before 2.13.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-78699 since 08/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.13.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_postgres

Website

• Product: https://github.com/ash-project/ash_postgres/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion