CVE-2026-45378

Received Received - Intake

Information Disclosure in Decidim via Active Storage URLs

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-45378

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	to 0.30.9 (exc)
decidim	decidim	From 0.31.0 (inc) to 0.31.5 (exc)
decidim	decidim	From 0.32.0.rc1 (inc) to 0.32.0.rc2 (exc)
decidim	decidim	0.30.9
decidim	decidim	0.31.5
decidim	decidim	0.32.0.rc2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Decidim, a participatory democracy framework. It allows unauthorized access to scanned identity documents through reusable signed Active Storage disk URLs. These URLs are embedded in admin UI pages and remain valid for seven days, letting anyone with the URL download the documents without authentication until the signature expires.

Detection Guidance

Check for Decidim versions between 0.30.0-0.30.8, 0.31.0-0.31.4, and 0.32.0.rc1-0.32.0.rc1. Inspect Active Storage disk URLs in admin UI for verification_attachment blobs. Look for unsigned or expired signed URLs in HTML responses.

Impact Analysis

If you use Decidim versions before 0.30.9, from 0.31.0 before 0.31.5, or 0.32.0.rc1 before 0.32.0.rc2, sensitive verification documents like ID scans could be exposed. Attackers could access these documents by obtaining the signed URLs, potentially leading to privacy breaches or identity theft.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The exposure of identity documents could result in non-compliance and legal penalties.

Mitigation Strategies

Upgrade Decidim to versions 0.30.9, 0.31.5, or 0.32.0.rc2 immediately. Review and revoke any active signed URLs for verification_attachment blobs. Ensure Active Storage URLs are configured with shorter expiration times.

Hi! I’m here to help you understand CVE-2026-45378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70