CVE-2026-75847: Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes.
AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignoreattributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignoreattributes defaults to empty, so the flag is effectively always false.
This issue affects ashpapertrail: from 0.1.1 before 0.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_paper_trailto a version that resolves this vulnerability.Fixed in 0.7.0 - Configuration
Configure AshPaperTrail.Resource.Transformers.CreateVersionResource so ignore_attributes is populated with the attribute names that are sensitive, since the changes map sensitivity is derived from ignore_attributes (attributes excluded from changes) rather than from the tracked attributes actually stored.
AshPaperTrail ignore_attributes = (set to include sensitive fields so they are excluded from the changes map sensitivity inference)
Event History
Frequently Asked Questions
Who can recover the exposed values?
An attacker needs read access to the generated version resource. Because the changes map is public, the version resource's default read action returns the plaintext values of tracked sensitive? attributes.
Are installations affected without custom ignore settings?
Yes. The ignore_attributes list defaults to empty, causing the generated changes map to be marked sensitive? false even when it stores tracked sensitive? attributes.
Where might the sensitive values be exposed besides API reads?
The plaintext changes map can also be printed in logs, inspect output, and error messages rather than being redacted.
Which versions are affected?
Affected versions are ash_paper_trail 0.1.1 through versions before 0.7.0.