Skip to content
OpenAdvisories

Package · RubyGems

decidim-verifications

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-45378

    Decidim: Verification documents can be downloaded through reusable links

    Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs,…

    decidim decidim decidim-verifications RubyGems
  • Medium 6.0
    CVE-2026-45415

    Decidim: CSV census record endpoints improper authorization

    Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or …

    decidim decidim decidim-verifications RubyGems
  • Medium 4.9
    CVE-2026-45330

    Decidim: Verification admins can access supplied IDs from other organisations

    Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming curre…

    decidim decidim decidim-verifications RubyGems