EUVD-2026-68143Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because version table read access is required; AC:H for the specific embedded-sensitive-field configuration precondition; PR:L because read access to the version resource constitutes a low-privilege credential.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.
sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.
This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
AnalysisAI
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in maybe_redact_changes/3 and AshPaperTrail.Resource.Changes.CreateNewVersion only inspects top-level resource attributes for the sensitive? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the application runs ash_paper_trail 0.3.0-0.6.x; (2) at least one Ash resource tracked by ash_paper_trail defines a non-sensitive top-level attribute whose type is an embedded resource, union, or array containing one or more attributes marked `sensitive? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H) scores 5.9 Medium, reflecting that exploitation is local in attack vector and requires a specific configuration precondition (AT:P): the target application must define at least one embedded resource or union type carrying `sensitive?` fields nested inside a non-sensitive top-level attribute. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_paper_trail to version 0.7.0 or later, which introduces recursive redaction of sensitive fields in embedded resources, union types, and arrays via the new `redact_dumped_value/4` helper. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Paper Trail
View allCleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor wi
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invok
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today