EUVD-2026-68265Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Tenant rename is typically network-exposed in SaaS apps; AC:H captures the required precondition of a pre-existing target schema; PR:L for tenant-level access; no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data.
AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data.
This issue affects ash_postgres: from 0.25.0 before 2.13.0.
AnalysisAI
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: (1) the application uses ash_postgres schema-based multi-tenancy via AshPostgres.MultiTenancy - applications using row-level or other non-schema tenancy strategies are unaffected; (2) the tenant rename operation (manage_tenant update action) is accessible to a user-controllable interface, not restricted exclusively to server-side administrative processes; (3) the attacker knows or can enumerate the PostgreSQL schema name of a target tenant; and (4) the target schema must already exist in PostgreSQL at the moment the rename is attempted - the AT:P precondition in the CVSS 4.0 vector explicitly captures this requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 7.2 with vector AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N reflects two mitigating constraints: low-privilege access is required to initiate a tenant rename, and AT:P captures a specific attack precondition - a target schema with the colliding name must already exist at the moment of the rename attempt. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_postgres to version 2.13.0 or later, which replaces the silent `Ecto.Adapters.SQL.query/2` call with the raising `Ecto.Adapters.SQL.query!/2` at `lib/multitenancy.ex:95`, ensuring PostgreSQL rename failures propagate as exceptions and cause the surrounding Ecto transaction to roll back before the tenant record is committed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today