Executive brief
Devise has a confirmable "change email" race condition permits user to confirm email they have no access to
Affected products
- RubyGems devise
Junglewise Threat Intelligence
CVE-2026-32700: Devise has a confirmable "change email" race condition permits user to confirm email they have no access to
CVE-2026-32700 · Severity: low · CVSS 3.1 · Published 2026-03-17
Technologies: devise (RubyGems). Vendors: RubyGems.