CVE-2026-96581 — An upsert on Ash’s primary key ignores attribute multitenancy

An upsert on Ash’s primary key ignores attribute multitenancy, allowing one tenant to read, overwrite, and take over another tenant’s data or resource.