CVE-2026-45378 decidim CVE debrief

Who should care

Defenders responsible for Decidim deployments should assess exposure and prioritize updates to prevent unauthorized access to verification documents. This includes reviewing current versions, identifying potentially vulnerable instances, and ensuring timely updates or mitigations. Additionally, defenders should monitor for suspicious activity related to verification documents and implement compensating controls where necessary. Security teams and operators

Why it matters

Decidim vulnerability allowing unauthorized access to verification documents via signed URLs, requiring updates and monitoring to prevent exploitation.

• Potential unauthorized access to sensitive verification documents
• Possible data exposure through signed URLs
• Need for verification and updates to prevent exploitation
• Monitoring for suspicious activity to detect potential misuse

Technical summary

The identity-document verification admin UI in Decidim embedded verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. This issue arises from Decidim's use of variant_url(...) to render verification-document images, producing signed /rails/active_storage/disk/... links that serve as credentials for seven days. The vulnerability affects Decidim versions prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2.

Defensive priority

Defenders should prioritize verifying and updating Decidim to the latest version, restricting access to verification documents, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2
• Restrict access to verification documents
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported in Decidim versions prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2. Verification-document images were rendered with variant_url(...), producing signed /rails/active_storage/disk/... links.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.