https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:49:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45330 <p>Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.</p> <p>Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45330 https://db.gcve.eu/vuln/ghsa-86fh-w43w-338c <p><strong>Affected:</strong> RubyGems: decidim-verifications</p> <p>## Description</p> <p>The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant.</p> <p>## Technical description</p> <p>The verification admin controllers loads pending_authorization_id with a raw `Authorization.find(...)` and then authorizes the record without checking whether it belongs to current_organization.</p> <p>Reproduction steps:</p> <p>1. An org2 participant uploads their ID:</p> <p>&lt;img width=&#34;2184&#34; height=&#34;1288&#34; alt=&#34;decidim-verification-01&#34; src=&#34;https://github.com/user-attachments/assets/c6713454-c787-4795-b852-3c2c672358d6&#34; /&gt;</p> <p>2. An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g `http://localhost:3001/admin/id_documents/pending_authorizations/35/confirmations/new`</p> <p>&lt;img width=&#34;1539&#34; height=&#34;1037&#34; alt=&#34;decidim-verification-02&#34; src=&#34;https://github.com/user-attachments/assets/6ed646de-a501-4964-8467-013ada55ce2d&#34; /&gt;</p> <p>3. The admin then approves this request by looking up the ID in the picture (not shown in this image, but a real ID would expose this) &lt;img width=&#34;1542&#34; height=&#34;652&#34; alt=&#34;decidim-verification-03&#34; src=&#34;https://github.com/user-attachments/assets/c7ee5bea-3fa2-43d9-8330-8d834f34a9af&#34; /&gt;</p> <p>4. Now the request has been approved, which can be seen from the org2 participant authorizations page:</p> <p>&lt;img width=&#34;2279&#34; height=&#34;720&#34; alt=&#34;decidim-verification-04&#34; src=&#34;https://github.com/user-attachments/assets/55ee1bab-d396-4e0f-803f-21dc31a2c125&#34; /&gt;</p> <p>### Impact</p> <p>A tenant a…</p> <p><strong>Affected:</strong> RubyGems: decidim-verifications</p> <p>## Description</p> <p>The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant.</p> <p>## Technical description</p> <p>The verification admin controllers loads pending_authorization_id with a raw `Authorization.find(...)` and then authorizes the record without checking whether it belongs to current_organization.</p> <p>Reproduction steps:</p> <p>1. An org2 participant uploads their ID:</p> <p>&lt;img width=&#34;2184&#34; height=&#34;1288&#34; alt=&#34;decidim-verification-01&#34; src=&#34;https://github.com/user-attachments/assets/c6713454-c787-4795-b852-3c2c672358d6&#34; /&gt;</p> <p>2. An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g `http://localhost:3001/admin/id_documents/pending_authorizations/35/confirmations/new`</p> <p>&lt;img width=&#34;1539&#34; height=&#34;1037&#34; alt=&#34;decidim-verification-02&#34; src=&#34;https://github.com/user-attachments/assets/6ed646de-a501-4964-8467-013ada55ce2d&#34; /&gt;</p> <p>3. The admin then approves this request by looking up the ID in the picture (not shown in this image, but a real ID would expose this) &lt;img width=&#34;1542&#34; height=&#34;652&#34; alt=&#34;decidim-verification-03&#34; src=&#34;https://github.com/user-attachments/assets/c7ee5bea-3fa2-43d9-8330-8d834f34a9af&#34; /&gt;</p> <p>4. Now the request has been approved, which can be seen from the org2 participant authorizations page:</p> <p>&lt;img width=&#34;2279&#34; height=&#34;720&#34; alt=&#34;decidim-verification-04&#34; src=&#34;https://github.com/user-attachments/assets/55ee1bab-d396-4e0f-803f-21dc31a2c125&#34; /&gt;</p> <p>### Impact</p> <p>A tenant a…</p> https://db.gcve.eu/vuln/ghsa-86fh-w43w-338c