GHSA-r3v7-5x4c-c69q CVE-2026-45414
Decidim: JWT-backed authentication can be replayed across organizations
- Severity
- 8.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.45%
- Chance of exploitation in the next 30 days. Higher than 39.43% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
0.31.5- Upgrade decidim to this version or later
Description
Description
A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that JWT to the Org 2 API to read Org 2 participant personal data and reach Org 2's proposal.answer mutation path.
Technical description
The current host selects the Decidim organization context, but JWT-backed API authentication is not sufficiently bound to that host organization. As a result, the API can process a request in Org 2's context while still trusting an authenticated principal from Org 1.
Reproduction steps:
- Use an API key provided by the system administrator that is assigned to organization 1 to create the JWT token or get the JWT token shown in the response when logged in as the organization admin.
<img width="1080" height="1119" alt="decidim-jwt-01" src="https://github.com/user-attachments/assets/6195a250-faef-41d5-8f64-4d77d4077e96" />
- When using this JWT token it is possible to retrieve details from other organisations. Notice the change of the host header in the request below to that of another tenant
org2.localhost:3001
<img width="1085" height="1047" alt="decidim-jwt-02" src="https://github.com/user-attachments/assets/d40825e3-0d36-44f3-bede-86d247bbe6d0" />
Note that using a participant-generated JWT did not allow showing these results.
Impact
A JWT issued for one organization can be replayed successfully against another organization's API and used to retrieve sensitive details from that organization.
Patches
See https://github.com/decidim/decidim/pull/16673 and https://github.com/decidim/decidim/pull/16756
Workarounds
Disable JWT credentials on system panel (/system)
References
OWASP A01:2021 Broken Access Control
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
Affected versions
RubyGems
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
decidim RubyGems → 0.31.5
- bundler
bundle update decidim # Gemfile: gem "decidim", ">= 0.31.5"
Severity breakdown
CVSS 3.1 8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Packages
Other links
- github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
- github.com/decidim/decidim/pull/16673
- github.com/decidim/decidim/pull/16756
- github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1
- github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c
- github.com/decidim/decidim/releases/tag/v0.31.5
- github.com/decidim/decidim/releases/tag/v0.32.0.rc2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3cx6-j9j4-54mp Decidim's private data exports can lead to data leaks | Medium | Also affects decidim |
| GHSA-cc4g-m3g7-xmw8 Decidim has a cross-site scripting vulnerability in the version control page | High | Also affects decidim |
| GHSA-vvqw-fqwx-mqmm Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor | Medium | Also affects decidim |
| GHSA-7cx8-44pc-xv3q Decidim cross-site scripting (XSS) in the pagination | High | Also affects decidim |
| GHSA-qcj6-vxwx-4rqv Decidim vulnerable to data disclosure through the embed feature | Medium | Also affects decidim |
| GHSA-9w99-78rj-hmxq Cross-site scripting (XSS) in the dynamic file uploads | Medium | Also affects decidim |
| GHSA-w3q8-m492-4pwp Possibility to circumvent the invitation token expiry period | High | Also affects decidim |
| GHSA-r275-j57c-7mf2 Race condition in Endorsements | Low | Also affects decidim |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor