CVE-2026-75847

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-75847

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75847.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-75847

Aliases

EEF-CVE-2026-75847
GHSA-wqjr-xmxp-j554

Published

2026-08-30T00:18:05.390Z

Modified

2026-08-30T11:45:15.919958616Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Details

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes.

AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignoreattributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignoreattributes defaults to empty, so the flag is effectively always false.

This issue affects ashpapertrail: from 0.1.1 before 0.7.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75847.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "e379ca90a0c4db54d07a9d1556fd12f2413f6e98"
                },
                {
                    "fixed": "90efdb0769f83f7c5daba6a87758daebf4baf32c"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-312"
    ],
    "cna_assigner": "EEF"
}

References

Affected packages

Git / github.com/ash-project/ash_paper_trail

Affected ranges

Type

GIT

Repo

https://github.com/ash-project/ash_paper_trail

Events

Introduced

e4f1a1527c84a1ba0ceffb271abcb72cb78fc92c

Fixed

e03925c19365697ceb099d2ceca9ee1f5ce8c8b8

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.1.1"
        },
        {
            "fixed": "0.7.0"
        }
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.2-rc.0

v0.1.3

v0.1.4

v0.2.0

v0.2.1

v0.3.0

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75847.json"