CVE-2026-77970
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-312
Almacenamiento de información sensible en texto claro
Fecha de publicación:
30/08/2026
Última modificación:
30/08/2026
Descripción
*** Pendiente de traducción *** Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.<br />
<br />
sensitive_attributes :redact and :ignore only act on the tracked resource&#39;s top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource&#39;s own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.<br />
<br />
This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
Impacto
Puntuación base 4.0
5.90
Gravedad 4.0
MEDIA