CVE-2026-32700 (GCVE-0-2026-32700)

Vulnerability from cvelistv5 – Published: 2026-03-18 20:55 – Updated: 2026-03-20 18:11
VLAI?
Title
Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to
Summary
Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes["unconfirmed_email"] = nil` as well.
Severity ?
6 (Medium)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version
heartcombo devise Affected: < 5.0.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32700",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T17:35:55.837904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T18:11:56.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/heartcombo/devise/issues/5783"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "devise",
          "vendor": "heartcombo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise\u0027s Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim\u0027s email address. When the attacker uses the token, the victim\u0027s email is confirmed on the attacker\u0027s account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T20:55:55.034Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc"
        },
        {
          "name": "https://github.com/heartcombo/devise/issues/5783",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/heartcombo/devise/issues/5783"
        },
        {
          "name": "https://github.com/heartcombo/devise/pull/5784",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/heartcombo/devise/pull/5784"
        },
        {
          "name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml"
        }
      ],
      "source": {
        "advisory": "GHSA-57hq-95w6-v4fc",
        "discovery": "UNKNOWN"
      },
      "title": "Devise has a confirmable \"change email\" race condition that permits user to confirm email they have no access to"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32700",
    "datePublished": "2026-03-18T20:55:55.034Z",
    "dateReserved": "2026-03-13T14:33:42.823Z",
    "dateUpdated": "2026-03-20T18:11:56.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32700",
      "date": "2026-04-17",
      "epss": "0.00016",
      "percentile": "0.0379"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32700\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-18T21:16:26.943\",\"lastModified\":\"2026-03-26T14:47:09.370\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise\u0027s Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim\u0027s email address. When the attacker uses the token, the victim\u0027s email is confirmed on the attacker\u0027s account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\\\"unconfirmed_email\\\"] = nil` as well.\"},{\"lang\":\"es\",\"value\":\"Devise es una soluci\u00f3n de autenticaci\u00f3n para Rails basada en Warden. Antes de la versi\u00f3n 5.0.3, una condici\u00f3n de carrera en el m\u00f3dulo Confirmable de Devise permite a un atacante confirmar una direcci\u00f3n de correo electr\u00f3nico que no posee. Esto afecta a cualquier aplicaci\u00f3n Devise que utilice la opci\u00f3n \u0027reconfirmable\u0027 (la predeterminada al usar Confirmable con cambios de correo electr\u00f3nico). Al enviar dos solicitudes concurrentes de cambio de correo electr\u00f3nico, un atacante puede desincronizar los campos `confirmation_token` y `unconfirmed_email`. El token de confirmaci\u00f3n se env\u00eda a un correo electr\u00f3nico que el atacante controla, pero el `unconfirmed_email` en la base de datos apunta a la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima. Cuando el atacante utiliza el token, el correo electr\u00f3nico de la v\u00edctima se confirma en la cuenta del atacante. Esto est\u00e1 parcheado en Devise v5.0.3. Los usuarios deben actualizar lo antes posible. Como soluci\u00f3n alternativa, las aplicaciones pueden sobrescribir un m\u00e9todo espec\u00edfico de los modelos de Devise para forzar que `unconfirmed_email` se persista cuando no ha cambiado. Tenga en cuenta que Mongoid no parece respetar que `will_change!` deber\u00eda forzar que el atributo se persista, incluso si realmente no cambi\u00f3, por lo que el usuario podr\u00eda tener que implementar una soluci\u00f3n alternativa similar a Devise estableciendo `changed_attributes[\\\"unconfirmed_email\\\"] = nil` tambi\u00e9n.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:heartcombo:devise:*:*:*:*:*:ruby:*:*\",\"versionEndExcluding\":\"5.0.3\",\"matchCriteriaId\":\"0B1D415E-F2DF-44BE-98F3-B7FD97B05D65\"}]}]}],\"references\":[{\"url\":\"https://github.com/heartcombo/devise/issues/5783\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/heartcombo/devise/pull/5784\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://github.com/heartcombo/devise/issues/5783\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Issue Tracking\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32700\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-20T17:35:55.837904Z\"}}}], \"references\": [{\"url\": \"https://github.com/heartcombo/devise/issues/5783\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-20T17:14:02.915Z\"}}], \"cna\": {\"title\": \"Devise has a confirmable \\\"change email\\\" race condition that permits user to confirm email they have no access to\", \"source\": {\"advisory\": \"GHSA-57hq-95w6-v4fc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"heartcombo\", \"product\": \"devise\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.0.3\"}]}], \"references\": [{\"url\": \"https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc\", \"name\": \"https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/heartcombo/devise/issues/5783\", \"name\": \"https://github.com/heartcombo/devise/issues/5783\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/heartcombo/devise/pull/5784\", \"name\": \"https://github.com/heartcombo/devise/pull/5784\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml\", \"name\": \"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise\u0027s Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim\u0027s email address. When the attacker uses the token, the victim\u0027s email is confirmed on the attacker\u0027s account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\\\"unconfirmed_email\\\"] = nil` as well.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-18T20:55:55.034Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32700\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-20T18:11:56.909Z\", \"dateReserved\": \"2026-03-13T14:33:42.823Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-18T20:55:55.034Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.