Data Leak Vulnerability in Decidim Participatory Democracy Framework
CVE-2025-65017
8.2HIGH
What is CVE-2025-65017?
The Decidim framework, utilized for facilitating participatory democracy, has a vulnerability that affects versions 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0. In these versions, improper UUID generation can result in UUID collisions, leading to unintended data exposures and potential user privacy violations. This issue can compromise the integrity of private data exports, making sensitive information accessible to unauthorized parties. Users are strongly encouraged to upgrade to versions 0.30.4 or 0.31.0 to mitigate risks associated with this vulnerability.
Affected Version(s)
decidim >= 0.30.0, < 0.30.4 < 0.30.0, 0.30.4
decidim >= 0.31.0.r1, < 0.31.0 < 0.31.0.r1, 0.31.0