{"id":"EEF-CVE-2026-75847","summary":"Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail","details":"## Summary\n\nCleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of `sensitive?` attributes.\n\nAshPaperTrail stores the values of tracked `sensitive?` attributes in the generated version resource's `changes` map, which is declared `public? true` and `sensitive? false`, so the values are returned by the version resource's default read action and printed in logs, `inspect` output, and error messages instead of being redacted. `AshPaperTrail.Resource.Transformers.CreateVersionResource` derives the `changes` map's sensitivity from the `ignore_attributes` list (the attributes excluded from `changes`) rather than from the tracked attributes actually stored in it, and `ignore_attributes` defaults to empty, so the flag is effectively always false.\n\nThis issue affects ash_paper_trail: from 0.1.1 before 0.7.0.\n\n## Configurations\n\nThe tracked resource must declare one or more `sensitive?` attributes that are not listed in `ignore_attributes`. Exposure requires read access to the generated version resource, which ships with `defaults [:read, ...]` and a `changes` field that is selectable by default.","aliases":["CVE-2026-75847","GHSA-wqjr-xmxp-j554"],"modified":"2026-09-08T02:15:03.056163959Z","published":"2026-08-30T00:18:05.390Z","database_specific":{"cpe_ids":["cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-312"],"capec_ids":["CAPEC-37"]},"references":[{"type":"ADVISORY","url":"https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-wqjr-xmxp-j554"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-75847.html"},{"type":"FIX","url":"https://github.com/ash-project/ash_paper_trail/commit/90efdb0769f83f7c5daba6a87758daebf4baf32c"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash_paper_trail"}],"affected":[{"package":{"name":"ash_paper_trail","ecosystem":"Hex","purl":"pkg:hex/ash_paper_trail"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.1"},{"fixed":"0.7.0"}]}],"versions":["0.1.1","0.1.2","0.1.2-rc.0","0.1.3","0.1.4","0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.6.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-75847.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/ash_paper_trail","events":[{"introduced":"e379ca90a0c4db54d07a9d1556fd12f2413f6e98"},{"fixed":"90efdb0769f83f7c5daba6a87758daebf4baf32c"}]}],"versions":["v0.6.0","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.3.0","v0.2.1","v0.2.0","v0.1.4","v0.1.3","v0.1.2","v0.1.2-rc.0","v0.1.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-75847.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"Zach Daniel / Ash Project","type":"REMEDIATION_DEVELOPER"},{"name":"Peter Ullrich","type":"FINDER"},{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}