Executive brief
AshPaperTrail is a library that tracks changes to database records for audit purposes. A flaw causes sensitive data marked for protection—such as passwords or API keys—to be stored in plaintext and exposed in logs, error messages, and API responses instead of being redacted, allowing anyone with read access to recover the original values.
Technical details
AshPaperTrail stores tracked sensitive attributes in a version resource's changes map, which is marked as public and non-sensitive, causing values to be returned unredacted by read actions and printed in logs and error messages. The root cause is that CreateVersionResource.Transformers derives the changes map's sensitivity from an ignore_attributes list (excluded attributes) rather than from the tracked sensitive attributes actually stored in it, and ignore_attributes defaults to empty, so the sensitivity flag is always false. An attacker with read access to the version resource can recover plaintext values of sensitive attributes. The vulnerability affects versions 0.1.1 through 0.6.x; patches are available in 0.7.0 and later.
Affected products
- ash-project AshPaperTrail 0.1.1 to 0.6.x
Timeline
- 2026-08-30: disclosed