EEF-CVE-2026-115627

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a `many_to_many` relationship, or a `through` relationship, is loaded with a lateral join (for example with a per-record limit or sort), `AshPostgres.DataLayer` builds the query for the join resource, and for each resource along a `through` path, in `lateral_join_query/3` and `through_step_queries/4` without running that resource's read action, which is where attribute multitenancy is applied. When those resources use `strategy :attribute` multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to. This issue affects ash_postgres: from 0.38.0 before 2.15.2. ## Impact A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant's join rows. ## Configurations Reachable when the join resource of a `many_to_many` relationship, or a resource along a `through` path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).