Ash-project Ash Postgres vulnerabilities

• ash-project ash postgres AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows CVE-2026-115627 Fix available 6.0 MediumOctober 25, 2026
• ash-project ash postgres AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set CVE-2026-115635 Fix available 6.0 MediumOctober 25, 2026
• ash-project ash postgres rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres CVE-2026-78699 Fix available 7.2 HighAugust 30, 2026
• ash framework ashpostgres, ash-project ash postgres +1 more AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. CVE-2024-49756 Fix available 5.3 MediumOctober 23, 2024