{"id":"CVE-2026-45414","aliases":["GHSA-r3v7-5x4c-c69q"],"url":"https://o3.security/vulnerability/CVE-2026-45414","summary":"Decidim: JWT-backed authentication can be replayed across organizations","details":"## Description\n\nA JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `participantDetails` field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that JWT to the Org 2 API to read Org 2 participant personal data and reach Org 2's `proposal.answer` mutation path.\n\n##  Technical description\n\nThe current host selects the Decidim organization context, but JWT-backed API authentication is not sufficiently bound to\nthat host organization. As a result, the API can process a request in Org 2's context while still trusting an authenticated\nprincipal from Org 1.\n\nReproduction steps:\n\n1. Use an API key provided by the system administrator that is assigned to organization 1 to create the JWT token or\nget the JWT token shown in the response when logged in as the organization admin.\n\n<img width=\"1080\" height=\"1119\" alt=\"decidim-jwt-01\" src=\"https://github.com/user-attachments/assets/6195a250-faef-41d5-8f64-4d77d4077e96\" />\n\n\n2. When using this JWT token it is possible to retrieve details from other organisations. Notice the change of the host header in the request below to that of another tenant `org2.localhost:3001`\n \n<img width=\"1085\" height=\"1047\" alt=\"decidim-jwt-02\" src=\"https://github.com/user-attachments/assets/d40825e3-0d36-44f3-bede-86d247bbe6d0\" />\n\nNote that using a participant-generated JWT did not allow showing these results.\n\n### Impact\n\nA JWT issued for one organization can be replayed successfully against another organization's API and used to retrieve sensitive details from that organization.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16673 and https://github.com/decidim/decidim/pull/16756\n\n### Workarounds\n\nDisable JWT credentials on system panel (`/system`) \n\n### References\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-08-06T19:17:17.988Z","modified":"2026-10-28T02:30:48.449976636Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"},"epss":{"score":0.00324,"percentile":0.25487,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.31.5"},{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1","label":"decidim/decidim@023e206"},"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.31.5"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45414.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45414"},{"type":"FIX","url":"https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1"},{"type":"FIX","url":"https://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c"},{"type":"WEB","url":"https://github.com/decidim/decidim/pull/16673"},{"type":"WEB","url":"https://github.com/decidim/decidim/pull/16756"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:48.449976636Z"}}