Executive brief
AshPaperTrail is a library that tracks changes to application data for audit and recovery purposes. This vulnerability allows anyone with database access to read sensitive information (such as API tokens or credentials) that was intended to be hidden, because the redaction rules only apply to top-level attributes and fail to protect sensitive data nested inside complex data structures like embedded resources, unions, or lists.
Technical details
The vulnerability is a cleartext storage issue in AshPaperTrail's change tracking mechanism. The root cause is that the `maybe_redact_changes/3` function and the stored-action-input path in `AshPaperTrail.Resource.Changes.CreateNewVersion` derive the sensitive attribute set from only the top-level attributes of a resource, failing to recursively check embedded resources, unions, or lists for sensitive fields. An attacker with read access to the version table can recover sensitive values (e.g., API tokens, passwords) nested inside non-sensitive attributes that contain embeds marked as sensitive. The vulnerability affects ash_paper_trail versions 0.3.0 through 0.6.x; a fix is available in 0.7.0 or later. No authentication bypass or code execution is possible, but information disclosure is certain for any sensitive data stored in nested structures.
Affected products
- ash-project ash_paper_trail 0.3.0 to 0.6.x
Timeline
- 2026-08-30: disclosed
- 2026-08-30: patched: Fix available in version 0.7.0 or later