EEF-CVE-2026-75847 CVE-2026-75847 GHSA-wqjr-xmxp-j554
Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.12%
- Chance of exploitation in the next 30 days. Higher than 1.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
- Fix
0.7.0- Upgrade ash_paper_trail to this version or later
Description
Summary
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes.
AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false.
This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
Configurations
The tracked resource must declare one or more sensitive? attributes that are not listed in ignore_attributes. Exposure requires read access to the generated version resource, which ships with defaults [:read, ...] and a changes field that is selectable by default.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_paper_trail | >= 0.1.1, < 0.7.0 |
0.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_paper_trail Hex → 0.7.0
- mix
{:ash_paper_trail, "~> 0.7.0"} # then: mix deps.update ash_paper_trail
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking | Not rated yet | Also affects ash_paper_trail |
| EEF-CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions | Not rated yet | Also affects ash_paper_trail |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-312 |
| GHSA-r6w9-259g-gwrv Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access | High | Same weakness, CWE-312 |
| GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter | High | Same weakness, CWE-312 |
| GHSA-g5xv-mhgm-v5f6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions | Medium | Same weakness, CWE-312 |
| GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth | Medium | Same weakness, CWE-312 |
| PYSEC-2026-3792 openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644)… | High | Same weakness, CWE-312 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor