EUVD-2026-68189Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable library in web apps; authenticated tenant session required (PR:L); high complexity due to mandatory strategy(:context) config and distinct-aggregate query path; scope change because another tenant's data is accessed.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.
When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.source alone, which is only the {table, schema} tuple and does not carry query.prefix or query.from.prefix. For strategy(:context) multitenancy those hold the tenant schema, so the rebuilt outer query reads the repo's default schema while the inner correlated subquery still reads the tenant schema, and the two are joined only on primary key. The aggregate, and any relationship join added off the prefix-less binding, is then computed against the wrong tenant's rows. The neighbouring limit and exists branches instead wrap the query with subquery/1, which preserves the prefix.
This issue affects ash_sql: from 0.1.0 before 0.7.1.
AnalysisAI
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to use ash_sql's strategy(:context) multitenancy mode, where tenant isolation is enforced via Ecto schema prefix fields rather than row-level attribute filters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 with AV:L and AT:P accurately characterizes a tightly scoped flaw: exploitation requires both strategy(:context) schema multitenancy configuration AND the specific distinct-aggregate query path - two prerequisites that substantially narrow the affected population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_sql to version 0.7.1 or later; the fix is contained in commit 3d95478cc9e1d5bfaf6144fe9b9793f29e5ab889 and confirmed by the vendor advisory at https://github.com/ash-project/ash_sql/security/advisories/GHSA-ww8j-58rc-f8h3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a sea
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today