{"id":"CVE-2026-45330","aliases":["GHSA-86fh-w43w-338c"],"url":"https://o3.security/vulnerability/CVE-2026-45330","summary":"Decidim: Verification admins can access supplied IDs from other organisations","details":"## Description\n\nThe verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant.\n\n## Technical description\n\nThe verification admin controllers loads pending_authorization_id with a raw `Authorization.find(...)` and then authorizes the record without checking whether it belongs to current_organization.\n\nReproduction steps:\n\n1. An org2 participant uploads their ID:\n\n<img width=\"2184\" height=\"1288\" alt=\"decidim-verification-01\" src=\"https://github.com/user-attachments/assets/c6713454-c787-4795-b852-3c2c672358d6\" />\n\n2. An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g `http://localhost:3001/admin/id_documents/pending_authorizations/35/confirmations/new`\n\n<img width=\"1539\" height=\"1037\" alt=\"decidim-verification-02\" src=\"https://github.com/user-attachments/assets/6ed646de-a501-4964-8467-013ada55ce2d\" />\n\n3. The admin then approves this request by looking up the ID in the picture (not shown in this image, but a real ID would expose this)\n \n<img width=\"1542\" height=\"652\" alt=\"decidim-verification-03\" src=\"https://github.com/user-attachments/assets/c7ee5bea-3fa2-43d9-8330-8d834f34a9af\" />\n\n4. Now the request has been approved, which can be seen from the org2 participant authorizations page:\n\n<img width=\"2279\" height=\"720\" alt=\"decidim-verification-04\" src=\"https://github.com/user-attachments/assets/55ee1bab-d396-4e0f-803f-21dc31a2c125\" />\n\n### Impact\n\nA tenant admin can access, reject or approve another tenant's `id_documents` requests.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16666\n\n### Workarounds\n\nDisable the \"Identity documents\" verification \n\n### Reference\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-07-31T22:05:21.773Z","modified":"2026-09-10T03:30:45.365701603Z","cvss":{"score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00347,"percentile":0.28171,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.30.9"},{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.31.5"},{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/pull/16666","label":"decidim/decidim#16666"},"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.30.9"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.31.5"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45330.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-86fh-w43w-338c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45330"},{"type":"WEB","url":"https://github.com/decidim/decidim/pull/16666"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:30:45.365701603Z"}}