Executive brief
Decidim, a participatory democracy framework, contains a vulnerability where sensitive data exports can be accessed by unauthorized individuals. While the initial request to download personal data requires a login, the system generates a temporary link that is not tied to the user's session. If this link is leaked through browser history, logs, or shared screenshots, anyone who obtains it can download the user's private data without needing a password.
Technical details
A broken access control vulnerability exists in Decidim's 'download_your_data' and private export flows. The `Decidim::DownloadYourDataController#download_file` method correctly authenticates the export owner but subsequently redirects the user to a signed Active Storage blob URL. This redirected URL acts as a bearer token and is not bound to the user's session, allowing it to be replayed by unauthenticated actors if intercepted. The vulnerability is particularly susceptible to leakage via browser history, proxy logs, or referer headers because the sensitive URL is delivered via a GET redirect chain. The fix introduces a `PrivateDownloads` logic that uses Rails' `send_data` to ensure file delivery remains within the authenticated session context. Patches are available in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Affected products
- decidim decidim < 0.30.9, >= 0.31.0.rc1 < 0.31.5, >= 0.32.0.rc1 < 0.32.0.rc2
Timeline
- 2026-04-30: other: Fix pull request submitted
- 2026-05-08: patched: Fix merged into develop branch
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date