EEF-CVE-2026-77970

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-77970.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-77970.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-77970
Aliases
Published
2026-08-30T00:18:22Z
Modified
2026-09-08T02:15:03Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
Details

Summary

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.

sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.

This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.

Configurations

The resource must version an attribute or accept an action input whose type is an embedded resource, union, or list containing a sensitive? field, with sensitive_attributes set to :redact or :ignore. Exposure requires read access to the generated version resource.

Database specific 
{
    "capec_ids": [
        "CAPEC-37"
    ],
    "cpe_ids": [
        "cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-312"
    ]
}
References
Credits
    • Peter Ullrich - FINDER
    • Peter Ullrich - REPORTER
    • Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - COORDINATOR

Affected packages

Hex / ash_paper_trail

Package

Name
ash_paper_trail
Purl
pkg:hex/ash_paper_trail

Affected ranges

Type
SEMVER
Events
Introduced
0.3.0
Fixed
0.7.0

Affected versions

0.*
0.3.0
0.3.1
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.6.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-77970.json"

Git / github.com/ash-project/ash_paper_trail

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_paper_trail
Events
Introduced
ffe5e03b14d26b73bff17f3eca811591788aba9c
Fixed
0cd4acfe7f48397673d8594fb5e2cd0f1bda6e40

Affected versions

v0.*
v0.3.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.6.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-77970.json"