Executive brief
Decidim, a participatory democracy framework, contains a security flaw in its identity verification system. In multi-tenant environments, an administrator from one organization can view, approve, or reject identity document requests belonging to a different organization. This could lead to the unauthorized exposure of sensitive personal identification documents and compromise the integrity of the verification process across different groups using the same platform.
Technical details
A broken access control vulnerability exists in Decidim's identity-document verification admin controllers. The software loads pending Authorization records using raw identifiers without verifying that the record belongs to the 'current_organization' of the logged-in administrator. This allows a high-privileged user (administrator) from one tenant to perform Insecure Direct Object Reference (IDOR) attacks to view, approve, or reject ID-document requests from other tenants. The issue is rooted in missing authorization checks (CWE-862) and authorization bypass through user-controlled keys (CWE-639). Patches are available in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Affected products
- Decidim Decidim < 0.30.9, >= 0.31.0 < 0.31.5, 0.32.0.rc1
Timeline
- 2026-05-12: patched: Versions 0.30.9 and 0.31.5 released with fixes
- 2026-07-31: advisory: CVE-2026-45330 published