Identity Document Verification Flaw in Decidim Framework
CVE-2026-45330
4.9MEDIUM
What is CVE-2026-45330?
The Decidim framework contains a vulnerability that permits an administrator from one tenant to access, approve, or reject identity-document requests of another tenant. This occurs due to the identity-document verification admin controllers loading pending Authorization records using raw identifiers without sufficient checks for current organization ownership. The issue was resolved in Decidim versions 0.30.9, 0.31.5, and 0.32.0.rc2, ensuring proper separation of tenant data.
Affected Version(s)
decidim < 0.30.9 < 0.30.9
decidim >= 0.31.0, < 0.31.5 < 0.31.0, 0.31.5
decidim >= 0.32.0.rc1, < 0.32.0.rc2 < 0.32.0.rc1, 0.32.0.rc2