EEF-CVE-2026-115635

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When `Ash.bulk_create/4` or a single create runs as an upsert with `return_skipped_upsert?: true` and the upsert is skipped (for example because its `upsert_condition` does not hold), `AshPostgres.DataLayer` reads the existing row back by the upsert identity in `do_bulk_create/3` and `upsert/4`. That lookup did not apply the resource's attribute multitenancy, so on a resource using `strategy :attribute` it could match and return the row of another tenant with the same identity values, exposing its fields to the caller. This issue affects ash_postgres: from 2.6.22 before 2.15.2. ## Impact A user of one tenant whose upsert is skipped receives another tenant's record with the same identity values. ## Configurations Reachable when a resource uses attribute multitenancy, an action performs upserts with `return_skipped_upsert?: true`, and a caller can supply identity values that another tenant also uses.