THREAT OPS › Threat News › [NVD] CVE-2026-81318 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.
When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 re
[NVD] CVE-2026-81318 — Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 re
CVE-2026-81318 CVSS: None Published: 2026-08-30T12:17:19.030
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows.
When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.source alone, whic
Indicators of compromise
- CVE-2026-81318cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-81318