EUVD-2026-68142Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via Ash API in typical deployments; PR:L because read access to the version resource is required; confidentiality-only impact with no integrity or availability consequence.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes.
AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false.
This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
AnalysisAI
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked sensitive? true. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must define one or more Ash resource attributes marked `sensitive? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N, score 5.9) designates a local attack vector with a specific attack requirement (AT:P), meaning exploitation depends on the application actually defining `sensitive?` attributes on tracked Ash resources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_paper_trail to version 0.7.0 or later, which contains the fix committed at https://github.com/ash-project/ash_paper_trail/commit/90efdb0769f83f7c5daba6a87758daebf4baf32c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Paper Trail
View allCleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invok
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today