Executive brief
ash_postgres is an Elixir library that manages PostgreSQL databases in multi-tenant applications, where each tenant's data is isolated in a separate database schema. A flaw in the tenant rename function fails to check if the rename operation succeeds, allowing an attacker with tenant management privileges to redirect a tenant's schema pointer to another tenant's existing schema, gaining unauthorized access to their data.
Technical details
The vulnerability is an unchecked return value in the AshPostgres.MultiTenancy.rename_tenant/3 function. The function calls Ecto.Adapters.SQL.query/2 to execute ALTER SCHEMA ... RENAME TO ... but discards the result without checking for success or failure. When PostgreSQL rejects the rename (e.g., because the target schema name already exists), the error is never propagated to the caller, and the function unconditionally returns :ok. The calling code then commits the tenant record with the new schema name, causing that tenant's future database operations to run against the wrong (existing) schema, resulting in cross-tenant data access. This requires the attacker to have permissions to initiate a tenant rename operation. Versions 0.25.0 through 2.12.x are affected; the vulnerability was patched in 2.13.0.
Affected products
- ash-project ash_postgres 0.25.0 to 2.12.x
Timeline
- 2026-08-30: disclosed