Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-45414 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CNA: [email protected]CVSS-B:8.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1	[email protected]	Source CodeVendor
https://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c	[email protected]	Source CodeVendor
https://github.com/decidim/decidim/releases/tag/v0.31.5	[email protected]	Release NotesVendor
https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2	[email protected]	Release NotesVendor
https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q	[email protected]	AdvisoryExploitRemedyVendor

see all 6 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]
CWE-863	Incorrect Authorization	[email protected]

Affected Products

Product	Versions
Decidim	< 0.32.0 (semver)
CPE cpe:2.3:a:decidim:decidim::::::ruby::* Remediation Upgrade: 0.31.5moderate effort To update, follow these steps: 1. Update your Gemfile: ```ruby gem "decidim", "0.31.5" gem "decidim-dev", "0.31.5" ``` 2. Run these commands: ```shell bundle update decidim bin/rails decidim:upgrade bin/rails db:migrate bin/rails data:migrate ``` Upgrade: 0.32.0.rc2moderate effort To update, follow these steps: 1. Update your Gemfile: ```ruby gem "decidim", "0.32.0.rc2" gem "decidim-dev", "0.32.0.rc" ``` 2. Run these commands: ```shell sudo apt install libvips libvips-tools # or the alternative installation process for your operating system. See "3.4. Replace image processing with imagemagick to libvips" bundle update decidim bin/rails decidim:upgrade sed -i "s/config\.load_defaults 7\.2/config\.load_defaults 8.1/g" config/application.rb # see "2.1. Ruby on Rails update to 8.1" wget https://raw.githubusercontent.com/decidim/decidim/refs/heads/release/0.32-stable/decidim-core/lib/decidim/shakapacker/shakapacker.yml -O config/shakapacker.yml -O config/shakapacker.yml # see "2.3. Shakapacker upgrade" bin/rails db:migrate bin/rails decidim:upgrade:encryption # see "5.1. Encryption mechanism changes" echo "/public/sw.js" >> .gitignore # see "2.5. Fix gitignore for ServiceWorker related files" bin/rails decidim:upgrade:remove_deleted_users_left_data # see "3.1. Remove user data left behind by `Decidim::DestroyAccount` bin/rails decidim:upgrade:fix_deleted_members_follows # see "3.2. Remove the follows of former private users" sed -i 's/Env.new("SMTP_STARTTLS_AUTO").to_boolean_string/Env.new("SMTP_STARTTLS_AUTO", true).present?/' config/environments/production.rb # see "3.5. Fix the "SMTP_STARTTLS_AUTO" env var in `production.rb`" bin/rails data:migrate ``` Workaround:*low effort Disable JWT credentials on system panel (`/system`).

Product

Versions

Decidim

< 0.32.0 (semver)

CPE

cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*

Remediation

Upgrade: 0.31.5moderate effort
To update, follow these steps: 1. Update your Gemfile: ```ruby gem "decidim", "0.31.5" gem "decidim-dev", "0.31.5" ``` 2. Run these commands: ```shell bundle update decidim bin/rails decidim:upgrade bin/rails db:migrate bin/rails data:migrate ```
Upgrade: 0.32.0.rc2moderate effort
To update, follow these steps: 1. Update your Gemfile: ```ruby gem "decidim", "0.32.0.rc2" gem "decidim-dev", "0.32.0.rc" ``` 2. Run these commands: ```shell sudo apt install libvips libvips-tools # or the alternative installation process for your operating system. See "3.4. Replace image processing with imagemagick to libvips" bundle update decidim bin/rails decidim:upgrade sed -i "s/config\.load_defaults 7\.2/config\.load_defaults 8.1/g" config/application.rb # see "2.1. Ruby on Rails update to 8.1" wget https://raw.githubusercontent.com/decidim/decidim/refs/heads/release/0.32-stable/decidim-core/lib/decidim/shakapacker/shakapacker.yml -O config/shakapacker.yml -O config/shakapacker.yml # see "2.3. Shakapacker upgrade" bin/rails db:migrate bin/rails decidim:upgrade:encryption # see "5.1. Encryption mechanism changes" echo "/public/sw.js*" >> .gitignore # see "2.5. Fix gitignore for ServiceWorker related files" bin/rails decidim:upgrade:remove_deleted_users_left_data # see "3.1. Remove user data left behind by `Decidim::DestroyAccount` bin/rails decidim:upgrade:fix_deleted_members_follows # see "3.2. Remove the follows of former private users" sed -i 's/Env.new("SMTP_STARTTLS_AUTO").to_boolean_string/Env.new("SMTP_STARTTLS_AUTO", true).present?/' config/environments/production.rb # see "3.5. Fix the "SMTP_STARTTLS_AUTO" env var in `production.rb`" bin/rails data:migrate ```
Workaround:low effort
Disable JWT credentials on system panel (`/system`).

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 7, 2026	CVE Modified	CISA-ADP
Aug 6, 2026	New CVE Received	[email protected]