https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 15:35:20 +0000 https://db.gcve.eu/vuln/cve-2026-96581 <p><strong>Affected:</strong> ash-project ash</p> <p>Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant&#39;s records via an upserting create action.</p> <p>Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request&#39;s tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record&#39;s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller&#39;s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller&#39;s own.</p> <p>This issue affects ash: from 1.22.0 before 3.37.2.</p> <p><strong>Affected:</strong> ash-project ash</p> <p>Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant&#39;s records via an upserting create action.</p> <p>Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request&#39;s tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record&#39;s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller&#39;s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller&#39;s own.</p> <p>This issue affects ash: from 1.22.0 before 3.37.2.</p> https://db.gcve.eu/vuln/cve-2026-96581