CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data. AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data. This issue affects ash_postgres: from 0.25.0 before 2.13.0.
Засегнати продукти
- ash-project ash_postgres: 0.25.0 преди 2.13.0
- ash-project ash_postgres: 03510dae24020e302558ef947be7ea874a9ce756 преди 8544ab15fe45784553c2d2da8ee1a388eee0174b
Вид слабост
История
- 30 август 2026 Публикувано
Други уязвимости в ash-project ash_postgres
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-78699
- https://nvd.nist.gov/vuln/detail/CVE-2026-78699
- https://github.com/ash-project/ash_postgres/security/advisories/GHSA-6fqq-j9c4-5766
- https://cna.erlef.org/cves/CVE-2026-78699.html
- https://osv.dev/vulnerability/EEF-CVE-2026-78699
- https://github.com/ash-project/ash_postgres/commit/8544ab15fe45784553c2d2da8ee1a388eee0174b