JWT Authentication Vulnerability in Decidim Framework
CVE-2026-45414
8.5HIGH
What is CVE-2026-45414?
The Decidim framework, which promotes participatory democracy, faces a vulnerability due to improper JWT-backed API authentication. This flaw allows a JSON Web Token issued for one organization to be reused against another organization's API. Consequently, this could enable unauthorized users to access sensitive participant details and manipulation capabilities within specific proposal data. This issue has been addressed in subsequent software versions: 0.31.5 and 0.32.0.rc2.
Affected Version(s)
decidim < 0.31.5 < 0.31.5
decidim >= 0.32.0.rc1, < 0.32.0.rc2 < 0.32.0.rc1, 0.32.0.rc2