CVE-2026-45330

Received Received - Intake

Authorization Bypass in Decidim Identity Verification

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-45330

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	to 0.30.9 (exc)
decidim	decidim	From 0.31.0 (inc) to 0.31.5 (exc)
decidim	decidim	to 0.32.0.rc2 (exc)
decidim	decidim	0.32.0.rc2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Decidim, a participatory democracy framework. It allows an administrator from one tenant to view, approve, or reject another tenant's identity-document verification requests due to improper authorization checks in the admin controllers. The issue exists in versions before 0.30.9, 0.31.5, and 0.32.0.rc2.

Detection Guidance

This vulnerability affects Decidim versions before 0.30.9, 0.31.5, and 0.32.0.rc2. To detect it, check your Decidim installation version using commands like 'bundle exec rake decidim:version' or inspecting Gemfile.lock. Verify if identity-document verification admin controllers improperly handle cross-tenant authorization records.

Impact Analysis

An attacker with admin access to one tenant could manipulate identity verification requests of another tenant, potentially leading to unauthorized approvals or rejections of sensitive documents. This could cause confusion, reputational damage, or misuse of verification processes.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by allowing unauthorized access to personal identity documents. It may also breach compliance requirements for secure identity verification processes, depending on the specific regulatory context.

Mitigation Strategies

Upgrade Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2 or later to address the authorization bypass in identity-document verification admin controllers.

Hi! I’m here to help you understand CVE-2026-45330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70