The vulnerability in AshPaperTrail causes sensitive attributes to be stored in a changes map that is publicly readable, allowing an attacker who has read access to a generated version resource to recover plaintext sensitive data. This cleartext storage of confidential information results in a confidentiality breach and potential exposure of personal data. The flaw is classified as CWE‑312, indicating that insecure data storage is exploited when data is inadvertently exposed in logs, inspection output, and error messages.

The issue affects the AshPaperTrail project, specifically versions starting with 0.1.1 up to, but not including, 0.7.0. Users running these releases are potentially exposed to confidential data leakage through public API endpoints that return version resource data.

The CVSS score of 5.9 indicates a medium severity vulnerability. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation likelihood. The attack vector is inferred to be external, requiring an attacker to obtain read permissions on a version resource; once achieved, the attacker can retrieve sensitive attributes directly from the public changes map. The risk is therefore moderate, owing to the need for privileged access but the consequence of cleartext data exposure.