← All credits
Will Townsend
4 vulnerability records and advisories credit this contributor.
CVE-2026-96581
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
CVE-2026-115635
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
CVE-2026-115627
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
CVE-2026-114214
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records