CVE-2026-45330mediumCWE-639CWE-862

CVE-2026-45330: medium-severity vulnerability in decidim

Decidim: Verification admins can access supplied IDs from other organisations

Published · Updated

Follow this CVE+ Monitor decidim+ Monitor decidim-verifications

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.5%
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
decidim · decidim
Related CVEs — decidim

In the same product, most dangerous first.

CVE-2023-34090HIGHDecidim vulnerable to sensitive data disclosureEPSS 1.3%CVE-2023-32693HIGHDecidim Cross-site Scripting vulnerability in the external link redirectionsEPSS 0.8%CVE-2023-48220MEDIUMDecidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodEPSS 0.8%CVE-2023-34089HIGHDecidim Cross-site Scripting vulnerability in the processes filterEPSS 0.7%CVE-2023-36465CRITICALDecidim has broken access control in templatesEPSS 0.7%CVE-2026-45376MEDIUMDecidim: Admin user search allows SQL injection through similarity-based sortingEPSS 0.6%