CVE-2026-75847

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-75847

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75847.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-75847

Aliases

EEF-CVE-2026-75847
GHSA-wqjr-xmxp-j554

Published

2026-08-30T00:18:05Z

Modified

2026-09-03T03:30:22Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Details

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes.

AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false.

This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-312"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75847.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "e379ca90a0c4db54d07a9d1556fd12f2413f6e98"
                },
                {
                    "fixed": "90efdb0769f83f7c5daba6a87758daebf4baf32c"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/ash-project/ash_paper_trail

Affected ranges

Type

GIT

Repo

https://github.com/ash-project/ash_paper_trail

Events

Introduced

e4f1a1527c84a1ba0ceffb271abcb72cb78fc92c

Fixed

e03925c19365697ceb099d2ceca9ee1f5ce8c8b8

Fixed

90efdb0769f83f7c5daba6a87758daebf4baf32c

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.1.1"
        },
        {
            "fixed": "0.7.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.2-rc.0

v0.1.3

v0.1.4

v0.2.0

v0.2.1

v0.3.0

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75847.json"