CVE-2026-45378 Decidim CVE debrief

Who should care

Decidim users, administrators, and developers who handle sensitive documents and verification processes should be aware of this vulnerability and take necessary actions to protect their systems and data.

Technical summary

The Decidim framework has a vulnerability in its identity-document verification admin UI. Prior to versions 0.30.9, 0.31.5, and 0.32.0.rc2, the UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs. These URLs allow unauthorized access to scanned documents without requiring an authenticated Decidim session until the signature expires. The vulnerability is due to the use of variant_url(...) which produces signed /rails/active_storage/disk/... links instead of routing files through an authorization-checking controller.

Defensive priority

Decidim users should verify and apply available updates to prevent unauthorized access to sensitive documents.

Recommended defensive actions

• Apply updates to Decidim versions 0.30.9, 0.31.5, or 0.32.0.rc2 and later
• Review and update Active Storage service configurations to minimize URL signature exposure
• Monitor for and restrict access to sensitive documents and verification_attachment blobs
• Implement compensating controls, such as authentication and authorization checks for document access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The issue involves Decidim's identity-document verification admin UI, which embeds verification_attachment blobs through reusable signed Active Storage disk URLs. These URLs allow anyone who obtains them to download scanned documents without an authenticated Decidim session until the signature expires. The vulnerability is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. Further investigation is needed to determine the full scope of affected systems and verify vendor remediation.

Official resources