GHSA-qx5f-ghc2-7g5c — ethyca-fides
Fix: ethyca/fides#7971GHSA-qx5f-ghc2-7g5c is a CWE-288 vulnerability in ethyca-fides. A fix is available for ethyca-fides — see the affected versions and patch details below.
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for GHSA-qx5f-ghc2-7g5c.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
ethyca-fidesReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment.
A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.
Am I affected?
This vulnerability only affects deployments that use Fides's privacy request (data subject request) features, also known collectively as "Lethe". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.
Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to true:
subject_identity_verification_requiredprivacy_request_duplicate_detection.enabled
Both settings default to false.
Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:
- Admin UI / configuration API - stored in the application database and applied at runtime
- Environment variables - read at webserver startup
fides.toml- read at webserver startup- Default value - used if none of the above set the value
To determine whether your deployment is affected, check each setting in every location that applies to your configuration management.
subject_identity_verification_required
fides.toml: under the[execution]section assubject_identity_verification_required = true- Environment variable:
FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true - No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API
privacy_request_duplicate_detection.enabled
fides.toml: under the[privacy_request_duplicate_detection]section asenabled = true- Environment variable:
FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true - Admin UI: Settings → Privacy requests → Duplicate detection, via the "Enable duplicate detection" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via
fides.tomlor environment variable will not appear here.
Details
When duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.
An attacker exploits this by submitting two privacy requests using a target's email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.
The fix for this vulnerability also patches a lower-severity issue, present in versions 2.82.0 through 2.83.1, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.
Impact
An unauthenticated attacker who knows a target's email address and can reach the public Privacy Center can cause an erasure privacy request to be approved by an administrator and processed without identity verification. The result is unauthorized deletion of the data subject's records across every integration configured in the affected deployment. Effects may be permanent and may cascade into downstream systems.
Access privacy requests are a less meaningful vector: the resulting access package is delivered to the data subject's registered email address, not to the attacker, so the attacker does not gain the data. The request still represents unauthorized processing.
Patches
The vulnerabilities have been patched in Fides OSS version 2.83.2. Users are advised to upgrade to this version or later to secure their systems against these threats.
Fides Enterprise (fidesplus) version 2.83.2 contains the same patch.
Workarounds
Disable duplicate detection by setting privacy_request_duplicate_detection.enabled to false. This can be changed under Settings → Privacy Requests → Duplicate detection in the Admin UI). This fully mitigates the vulnerability and is the recommended interim workaround for deployments that cannot immediately upgrade.
Administrators of deployments that must retain duplicate detection should deny or delete, rather than approve, any privacy request whose identity has not been verified. This reduces the likelihood of exploitation but relies on administrator vigilance during each triage action.
<img width="1392" height="1044" alt="GHSA - Admin Approval of Unverified Privacy Request" src="https://github.com/user-attachments/assets/b2ad4940-40d3-468b-897e-8cca6ce4707e" /> <figcaption> <em> An administrator's view when approving an unverified privacy request in the Admin UI. </em> </figcaption> </figure>Severity
This vulnerability has been assigned a severity of MEDIUM.
The rating reflects the fact that exploitation requires an administrator to approve the malicious request. An attacker alone cannot cause a privacy request to be processed. The administrative interface understates the verification state of a duplicate-classified request, which increases the likelihood of inadvertent approval during routine triage, but without administrator user interaction the vulnerability is not exploitable.
The related denial-of-service issue addressed in the same patch is also rated medium-severity in isolation and does not raise the overall severity of this advisory.
References
- Fides OSS
2.83.2release: https://github.com/ethyca/fides/releases/tag/2.83.2 - Fix for the identity bypass vulnerability: PR #7972, commit
e7a6527 - Fix for the related denial-of-service issue: PR #7971, commit
0e320b2
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | ethyca-fides | ≥ 2.75.0&&< 2.83.2 | 2.83.2pip install --upgrade 'ethyca-fides==2.83.2' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ethyca-fides, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ethyca-fides to 2.83.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qx5f-ghc2-7g5c is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-qx5f-ghc2-7g5c can be triaged on real exposure rather than presence alone.
Tailored to GHSA-qx5f-ghc2-7g5c. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-qx5f-ghc2-7g5c in your dependencies?
O3 Security finds GHSA-qx5f-ghc2-7g5c across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.