PT-2026-60067 · Decidim+1 · Decidim+1
CVE-2026-45330
·
Published
2026-07-13
·
Updated
2026-07-31
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Decidim versions prior to 0.30.9
Decidim versions 0.31.0 through 0.31.4
Decidim version 0.32.0.rc1
Description
Identity-document verification admin controllers load pending authorization records using a raw identifier without verifying ownership of the
current organization. This broken access control allows an administrator from one tenant to view, approve, or reject ID-document requests belonging to another tenant. The issue occurs because the controllers use Authorization.find(...) to load the pending authorization id without checking if the record belongs to the current organization. This can be exploited via the endpoint /admin/id documents/pending authorizations/{id}/confirmations/new.Recommendations
Update to version 0.30.9.
Update to version 0.31.5.
Update to version 0.32.0.rc2.
As a temporary workaround, disable the Identity documents verification feature.
Fix
Information Disclosure
Missing Authorization
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Decidim
Decidim-Verifications