CVE-2026-75847
Received Received - Intake

Cleartext Storage of Sensitive Data in AshPaperTrail

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-75847
EUVD
EUVD-2026-68142

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_paper_trail From 0.1.1 (inc) to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves cleartext storage of sensitive information in the ash_paper_trail library. Sensitive attribute values are stored in a public changes map that is not marked as sensitive, allowing attackers with read access to recover plaintext of sensitive data. The issue occurs because the system incorrectly determines the sensitivity of the changes map based on ignored attributes rather than tracked ones.

Detection Guidance

To detect this vulnerability, check if your ash_paper_trail version is between 0.1.1 and 0.7.0. Inspect logs, error messages, and inspect output for plaintext sensitive attributes in version resources. Verify if sensitive attributes are exposed in public changes maps.

Impact Analysis

An attacker with read access to the version resource could retrieve sensitive data such as passwords, tokens, or personally identifiable information. This exposure happens through logs, inspect output, or error messages where the data is printed in plaintext instead of being redacted.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Unauthorized access to such data violates these regulations.

Mitigation Strategies

Update ash_paper_trail to version 0.7.0 or later. Review and update ignore_attributes to include all sensitive attributes. Ensure version resources restrict read access to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart