Authorization Flaw in Decidim Framework Allows Unrestricted Data Access
CVE-2026-45377
What is CVE-2026-45377?
The Decidim framework, a tool for participatory democracy, has a significant vulnerability that allows unauthorized access to user data. The flaw exists in the 'download_your_data' functionality, where the system only verifies the export owner's identity during authentication, but the resulting URL for the Active Storage blob can be accessed by anyone who possesses it. This creates a scenario where sensitive data can be retrieved without proper authentication, as the signed URL is not tied to the user session. This vulnerability has been remedied in the later versions of Decidim: 0.30.9, 0.31.5, and 0.32.0.rc2. Organizations using affected versions are urged to update as soon as possible to mitigate potential risks.
Affected Version(s)
decidim < 0.30.9 < 0.30.9
decidim >= 0.31.0.rc1, < 0.31.5 < 0.31.0.rc1, 0.31.5
decidim >= 0.32.0.rc1, < 0.32.0 < 0.32.0.rc1, 0.32.0