CVE-2026-75847: AshPaperTrail Sensitive Attribute Exposure Vulnerability
Summary
CVE-2026-75847: Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail. Affects ash_paper_trail across 2 version ranges.
>= 0.1.1, < 0.7.0
>= e379ca90a0c4db54d07a9d1556fd12f2413f6e98, < 90efdb0769f83f7c5daba6a87758daebf4baf32c
Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPaperTrail is an open-source library designed for tracking changes in resources within applications built on the Ash framework. It provides functionality to log changes made to attributes of resources, allowing developers to maintain a history of modifications. The library includes features for marking certain attributes as sensitive, which should ideally prevent their exposure in logs and public outputs. However, a significant vulnerability exists that compromises this functionality, allowing sensitive data to be exposed.
Vulnerability Detail
The vulnerability identified as CVE-2026-75847 arises from the improper handling of sensitive attributes in AshPaperTrail. Specifically, the library stores the values of sensitive attributes in a public changes map, which is accessible to users with read access to the generated version resource. This means that sensitive information can be retrieved in cleartext, leading to potential data breaches. The issue is rooted in the way the library determines the sensitivity of attributes, relying on an ignore_attributes list that defaults to empty, thus failing to protect sensitive data effectively. This vulnerability affects versions of AshPaperTrail from 0.1.1 up to, but not including, 0.7.0.
How To Fix
Latest published version: 0.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually configure the ignore_attributes list to include all sensitive attributes, thereby preventing them from being logged or exposed. This can be done by modifying the resource configuration as follows: 'ignore_attributes: [:sensitive_attribute1, :sensitive_attribute2]'. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
CVE-2026-75847 represents a significant risk for applications using AshPaperTrail, as it exposes sensitive attribute values due to improper configuration. It is crucial for developers to update to the patched version 0.7.0 or later to protect sensitive information and maintain application security.
See every vulnerability recorded for ash_paper_trail →
FAQ
CVE-2026-75847 is a vulnerability in the AshPaperTrail library that allows sensitive attribute values to be exposed in cleartext due to improper handling of the changes map.
Versions of AshPaperTrail from 0.1.1 up to, but not including, 0.7.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, you can temporarily configure the ignore_attributes list to include sensitive attributes to mitigate exposure.
The CVSS score for CVE-2026-75847 is 5.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash_paper_trail.
