CVE-2026-45377: Decidim improper access control in Private Data Exports

CVE-2026-45377 · Severity: medium · CVSS 6.5 · Published 2026-07-31

Decidim, a participatory democracy framework, contains a vulnerability where sensitive data exports can be accessed by unauthorized individuals. While the initial request to download personal data requires a login, the system generates a temporary link that is not tied to the user's session. If this link is leaked through browser history, logs, or shared screenshots, anyone who obtains it can download the user's private data without needing a password.

Technologies: Decidim, decidim-core (RubyGems). Vendors: Decidim, RubyGems.

Quick answers

Is CVE-2026-45377 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45377 being exploited in the wild.
How severe is CVE-2026-45377?
Medium severity, with a CVSS score of 6.5, published 31 July 2026.
Which products and versions are affected?
Decidim < 0.30.9, >= 0.31.0.rc1 < 0.31.5, >= 0.32.0.rc1 < 0.32.0.rc2; decidim-core (RubyGems) ECOSYSTEM:introduced=0,fixed=0.30.9.
Is there a fix for CVE-2026-45377?
Yes. decidim-core (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45377 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45377?
Check whether you run Decidim or decidim-core (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • decidim-core (RubyGems): upgrade to 0.30.9 or later
    bundle update decidim-core

Technical details

A broken access control vulnerability exists in Decidim's 'download_your_data' and private export flows. The `Decidim::DownloadYourDataController#download_file` method correctly authenticates the export owner but subsequently redirects the user to a signed Active Storage blob URL. This redirected URL acts as a bearer token and is not bound to the user's session, allowing it to be replayed by unauthenticated actors if intercepted. The vulnerability is particularly susceptible to leakage via browser history, proxy logs, or referer headers because the sensitive URL is delivered via a GET redirect chain. The fix introduces a `PrivateDownloads` logic that uses Rails' `send_data` to ensure file delivery remains within the authenticated session context. Patches are available in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Affected products

  • decidim decidim < 0.30.9, >= 0.31.0.rc1 < 0.31.5, >= 0.32.0.rc1 < 0.32.0.rc2

Identifiers

  • CVE-2026-45377
  • GHSA-767h-63j4-5226

Timeline

  • 2026-04-30: other: Fix pull request submitted
  • 2026-05-08: patched: Fix merged into develop branch
  • 2026-07-13: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.