Ash Paper Trail CVE-2026-77970

Exploitation requires three concurrent conditions: (1) the application runs ash_paper_trail 0.3.0-0.6.x; (2) at least one Ash resource tracked by ash_paper_trail defines a non-sensitive top-level attribute whose type is an embedded resource, union, or array containing one or more attributes marked sensitive? true - for example, an accepted_credentials embed carrying a token field; and (3) the attacker has read access to the Ash version resource table, whether via database credentials, a privileged application user, or a secondary read path such as an audit log viewer. Exploitation is NOT possible when all sensitive data lives only in top-level attributes already covered by sensitive_attributes :redact or :ignore, nor when the attacker lacks any read path to the version table. The local attack vector (AV:L) in the CVSS 4.0 vector confirms that remote unauthenticated exploitation is not applicable; some form of local or credentialed access to the version data store is a prerequisite.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H) scores 5.9 Medium, reflecting that exploitation is local in attack vector and requires a specific configuration precondition (AT:P): the target application must define at least one embedded resource or union type carrying sensitive? fields nested inside a non-sensitive top-level attribute. EPSS data was not provided; KEV status is absent, and no public exploit code has been identified, so real-world exploitation pressure is low at this time. The confidentiality impact is rated High because credentials, tokens, or API keys stored in embedded structures could be fully recovered from audit logs. Integrity and availability are unaffected. The practical blast radius is bounded by (a) the niche adoption footprint of ash_paper_trail itself and (b) the requirement that applications use the specific pattern of non-sensitive parent attributes wrapping sensitive embedded children - a common enough anti-pattern in credential-handling code that security teams should not dismiss this as theoretical. Overall: medium-priority remediation appropriate for most operators, urgent only for applications that store credential embeds in audit-trailed resources.

An attacker who has obtained read access to the application's version/audit table - through a compromised read-only database credential, an overprivileged application role, or direct database access - queries stored version records for resources that accept credential embeds. Because the parent attribute is not marked sensitive, the full embedded structure including tokens or passwords is stored in plaintext JSON, allowing the attacker to extract valid credentials directly from the audit log without interacting with the live application.