CVE-2026-78699: CWE-252 Unchecked Return Value in ash-project ash_postgres

The vulnerability arises because ash_postgres's MultiTenancy.rename_tenant/3 function issues an ALTER SCHEMA ... RENAME TO ... command using Ecto.Adapters.SQL.query/2, which returns {:ok, _} or {:error, _}. However, the function discards this result and always returns :ok. When the rename target schema already exists, PostgreSQL rejects the rename, but this failure is not propagated to the caller. Consequently, the calling manage_tenant update action commits the tenant row with the new name, which corresponds to a different existing tenant's schema. This leads to subsequent tenant operations accessing another tenant's data, breaching tenant isolation.

An attacker with the ability to rename tenants can cause their tenant record to point to another tenant's schema, gaining unauthorized access to that tenant's live data. This breaks tenant data isolation and confidentiality, potentially exposing sensitive information across tenants. The vulnerability requires low privileges (local access) and no user interaction, but the attacker must be able to perform tenant renames.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid performing tenant renames or restrict this operation to trusted administrators only. Monitor for any updates from the ash-project vendor regarding an official fix or workaround.