FKIE_CVE-2026-45414

Vulnerability from fkie_nvd - Published: 2026-08-06 22:17 - Updated: 2026-08-07 18:17
Severity
8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Summary
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
References
security-advisories@github.comhttps://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1
security-advisories@github.comhttps://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c
security-advisories@github.comhttps://github.com/decidim/decidim/releases/tag/v0.31.5
security-advisories@github.comhttps://github.com/decidim/decidim/releases/tag/v0.32.0.rc2
security-advisories@github.comhttps://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "decidim",
          "vendor": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0.rc2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant\u2019s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2."
    }
  ],
  "id": "CVE-2026-45414",
  "lastModified": "2026-08-07T18:17:15.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45414",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T17:50:28.456696Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:17:06.873",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/releases/tag/v0.31.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.