Vulnerability-Lookup

CVE-2026-45378 (GCVE-0-2026-45378)

Vulnerability from cvelistv5 – Published: 2026-08-06 20:15 – Updated: 2026-08-07 16:51

Title

Decidim: Verification documents can be downloaded through reusable links

Summary

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 16:50 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8073 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/decidim/decidim/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
decidim	decidim	Affected: < 0.30.9 Affected: >= 0.31.0.rc1, < 0.31.5 Affected: >= 0.32.0.rc1, < 0.32.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45378",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T16:50:47.559928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T16:51:44.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "decidim",
          "vendor": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T20:15:40.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
        }
      ],
      "source": {
        "advisory": "GHSA-3mvf-82qp-8qh5",
        "discovery": "UNKNOWN"
      },
      "title": "Decidim: Verification documents can be downloaded through reusable links"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45378",
    "datePublished": "2026-08-06T20:15:40.126Z",
    "dateReserved": "2026-05-12T00:51:29.086Z",
    "dateUpdated": "2026-08-07T16:51:44.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45378",
      "date": "2026-11-06",
      "epss": "0.00416",
      "percentile": "0.36077"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "decidim",
                "vendor": "decidim",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.30.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
          }
        ],
        "id": "CVE-2026-45378",
        "lastModified": "2026-09-08T20:51:43.490",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-45378",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T16:50:47.559928Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-06T22:17:06.690",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-45378",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-07T16:50:47.559928Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-07T16:51:32.157Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "decidim",
              "vendor": "decidim",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.30.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T20:15:40.126Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
            }
          ],
          "source": {
            "advisory": "GHSA-3mvf-82qp-8qh5",
            "discovery": "UNKNOWN"
          },
          "title": "Decidim: Verification documents can be downloaded through reusable links"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-45378",
        "datePublished": "2026-08-06T20:15:40.126Z",
        "dateReserved": "2026-05-12T00:51:29.086Z",
        "dateUpdated": "2026-08-07T16:51:44.298Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45378

Vulnerability from fkie_nvd - Published: 2026-08-06 22:17 - Updated: 2026-09-08 20:51

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "decidim",
          "vendor": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
    }
  ],
  "id": "CVE-2026-45378",
  "lastModified": "2026-09-08T20:51:43.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45378",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T16:50:47.559928Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:17:06.690",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3MVF-82QP-8QH5

Vulnerability from github – Published: 2026-07-13 17:10 – Updated: 2026-07-13 17:10

Summary

Decidim: Verification documents can be downloaded through reusable links

Details

Description

Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/active_storage/disk/ URLs that can be fetched without any authenticated session.

Anyone who obtains one of those URLs can retrieve the document until the signature expires.

Technical description

This issue comes from the verification admin UI exposing scanned documents through reusable Active Storage disk links. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period.

The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views.

Reproduction steps:

Create a fresh verification document as a normal user. 1.1. Open http://localhost:3001/users/sign_in. 1.2. Open http://localhost:3001/id_documents/authorizations/new. 1.3. Submit an id_documents verification request with an image attachment.
Open the admin review page that renders the attachment. 2.1. Sign out. 2.2. Sign back in as admin@example.org. 2.3. Try http://localhost:3001/admin/id_documents.
Harvest the signed Active Storage URL. 3.1. Open DevTools Network before loading the review page. 3.2. Reload the page. 3.3. Copy one request URL matching http://localhost:3001/rails/active_storage/disk/<SIGNED_TOKEN>/<FILENAME>.
Replay the file URL without any Decidim session. 4.1. Open a private window or a second browser where you are not signed in to Decidim. 4.2. Paste the exact copied /rails/active_storage/disk/... URL. 4.3. Confirm the verification image still loads.

Impact

This only applies to Organizations using the "Identity documents" verification
Any party that obtains one of these URLs can download the underlying scanned identity document for the lifetime of the signed link without needing to authenticate as the reviewing admin.
In the reproduced case, that replay window was about seven days, which is long enough for routine leakage channels such as copied links, screenshots, logs, browser history, and support workflows to become realistic exfiltration paths.
This raises the risk of leakage through browser history, screenshots, copy-paste, support tickets, logs, analytics tooling, malicious browser extensions, or any other channel that captures full URLs.
Because the affected files are identity-verification documents, the exposed data can include highly sensitive personal information.

Patches

See https://github.com/decidim/decidim/pull/16680

Workarounds

Disable the "Identity documents" verification

Reference

OWASP A01:2021 Broken Access Control

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-verifications"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.30.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-verifications"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.31.0.rc1"
            },
            {
              "fixed": "0.31.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-verifications"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.32.0.rc1"
            },
            {
              "fixed": "0.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-13T17:10:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Description\n\nScanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed `/rails/active_storage/disk/` URLs that can be fetched without any authenticated session.\n\nAnyone who obtains one of those URLs can retrieve the document until the signature expires.\n\n## Technical description\n\nThis issue comes from the verification admin UI exposing scanned documents through reusable Active Storage disk links. Verification-document images are rendered with `variant_url(...)`, which produces signed `/rails/active_storage/disk/...` links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period.\n\nThe affected files are `verification_attachment` blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views.\n\nReproduction steps:\n\n1. Create a fresh verification document as a normal user.\n1.1. Open http://localhost:3001/users/sign_in.\n1.2. Open http://localhost:3001/id_documents/authorizations/new.\n1.3. Submit an id_documents verification request with an image attachment.\n\n2. Open the admin review page that renders the attachment.\n2.1. Sign out.\n2.2. Sign back in as admin@example.org.\n2.3. Try http://localhost:3001/admin/id_documents.\n\n3. Harvest the signed Active Storage URL.\n3.1. Open DevTools Network before loading the review page.\n3.2. Reload the page.\n3.3. Copy one request URL matching `http://localhost:3001/rails/active_storage/disk/\u003cSIGNED_TOKEN\u003e/\u003cFILENAME\u003e`.\n\n4. Replay the file URL without any Decidim session.\n4.1. Open a private window or a second browser where you are not signed in to Decidim.\n4.2. Paste the exact copied /rails/active_storage/disk/... URL.\n4.3. Confirm the verification image still loads.\n\n### Impact\n\n- This only applies to Organizations using the \"Identity documents\" verification\n- Any party that obtains one of these URLs can download the underlying scanned identity document for the lifetime of the signed link without needing to authenticate as the reviewing admin.\n- In the reproduced case, that replay window was about seven days, which is long enough for routine leakage channels such as copied links, screenshots, logs, browser history, and support workflows to become realistic exfiltration paths.\n- This raises the risk of leakage through browser history, screenshots, copy-paste, support tickets, logs, analytics tooling, malicious browser extensions, or any other channel that captures full URLs.\n- Because the affected files are identity-verification documents, the exposed data can include highly sensitive personal information.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16680\n\n### Workarounds\n\nDisable the \"Identity documents\" verification \n\n### Reference\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).",
  "id": "GHSA-3mvf-82qp-8qh5",
  "modified": "2026-07-13T17:10:12Z",
  "published": "2026-07-13T17:10:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/pull/16680"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decidim/decidim"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Decidim: Verification documents can be downloaded through reusable links"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45378 (GCVE-0-2026-45378)

FKIE_CVE-2026-45378

GHSA-3MVF-82QP-8QH5

Description

Technical description

Impact

Patches

Workarounds

Reference

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour