Skip to content
OpenAdvisories

Package · RubyGems

devise_invitable

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.7
    CVE-2023-48220

    Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

    Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset function…

    decidim decidim decidim decidim-admin RubyGems