Loading...
Skip to main content
GeekWala

CVE-2026-45330 — Vulnerability in decidim-verifications — CVE Details

MEDIUM

Decidim: Verification admins can access supplied IDs from other organizations

Published July 13, 2026Updated July 13, 2026Source: osv

Summary

## Description The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant. ## Technical description The verification admin controllers loads pending_authorization_id with a raw `Authorization.find(...)` and then authorizes the record without checking whether it belongs to current_organization. Reproduction steps: 1. An org2 participant uploads their ID: <img width="2184" height="1288" alt="decidim-verification-01" src="https://github.com/user-attachments/assets/c6713454-c787-4795-b852-3c2c672358d6" /> 2. An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g `http://localhost:3001/admin/id_documents/pending_authorizations/35/confirmations/new` <img width="1539" height="1037" alt="decidim-verification-02" src="https://github.com/user-attachments/assets/6ed646de-a501-4964-8467-013ada55ce2d" /> 3. The admin then approves this request by looking up the ID in the picture (not shown in this image, but a real ID would expose this) <img width="1542" height="652" alt="decidim-verification-03" src="https://github.com/user-attachments/assets/c7ee5bea-3fa2-43d9-8330-8d834f34a9af" /> 4. Now the request has been approved, which can be seen from the org2 participant authorizations page: <img width="2279" height="720" alt="decidim-verification-04" src="https://github.com/user-attachments/assets/55ee1bab-d396-4e0f-803f-21dc31a2c125" /> ### Impact A tenant admin can access, reject or approve another tenant's `id_documents` requests. ### Patches See https://github.com/decidim/decidim/pull/16666 ### Workarounds Disable the "Identity documents" verification ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).

Advisory Timeline

  • First published July 13, 2026 (91 days ago).
  • Last revised July 13, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update decidim-verifications to 0.30.9 or later
gem install decidim-verifications -v 0.30.9
Bundler
Update decidim-verifications to 0.31.5 or later
gem install decidim-verifications -v 0.31.5
Bundler
Update decidim-verifications to 0.32.0 or later
gem install decidim-verifications -v 0.32.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
decidim-verifications
rubygems
0.10.0, 0.10.1, 0.11.0.pre1, 0.11.1 (+116 more)0.30.9
decidim-verifications
rubygems
0.31.0, 0.31.0.rc1, 0.31.0.rc2, 0.31.1 (+3 more)0.31.5
decidim-verifications
rubygems
0.32.0.rc1, 0.32.0.rc2, 0.32.0.rc30.32.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-200
    Information ExposureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2026-45330?
Decidim: Verification admins can access supplied IDs from other organizations This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 4.9/10).
How do I check if my project is affected by CVE-2026-45330?
CVE-2026-45330 affects decidim-verifications. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-45330 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
4.9

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-86fh-w43w-338c

Related CVEs

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies