Is CVE-2026-45378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45378 being exploited in the wild.

How severe is CVE-2026-45378?

High severity, with a CVSS score of 7.5, published 13 July 2026.

Which products and versions are affected?

decidim-verifications (RubyGems) ECOSYSTEM:introduced=0,fixed=0.30.9.

Is there a fix for CVE-2026-45378?

Yes. decidim-verifications (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45378 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45378?

Check whether you run decidim-verifications (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45378: Decidim sensitive document exposure via reusable Active Storage links

CVE-2026-45378 · Severity: high · CVSS 7.5 · Published 2026-07-13

Decidim is a participatory democracy platform used by public institutions and organizations. A vulnerability in its identity verification system allows sensitive documents, such as scanned ID cards, to be accessed by unauthorized parties via reusable links. These links remain valid for seven days and can be leaked through browser history, logs, or screenshots, potentially leading to the exposure of highly sensitive personal information.

Technologies: decidim-verifications (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-45378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45378 being exploited in the wild.
How severe is CVE-2026-45378?: High severity, with a CVSS score of 7.5, published 13 July 2026.
Which products and versions are affected?: decidim-verifications (RubyGems) ECOSYSTEM:introduced=0,fixed=0.30.9.
Is there a fix for CVE-2026-45378?: Yes. decidim-verifications (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45378 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45378?: Check whether you run decidim-verifications (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

decidim-verifications (RubyGems): upgrade to 0.30.9 or later
```
bundle update decidim-verifications
```

Technical details

The Decidim verification admin UI exposes scanned identity documents using reusable Active Storage disk links generated via 'variant_url(...)'. These links bypass standard authorization-checking controllers and are signed to remain valid for seven days by default. Because the signed URL acts as the sole credential, any party that obtains the link (e.g., through browser history, server logs, or analytics) can download the 'verification_attachment' blobs without authentication. The vulnerability affects the 'decidim-verifications' gem in versions prior to 0.30.9, 0.31.5, and 0.32.0. Patches have been released to route these files through proper authorization checks.

Affected products

Decidim decidim-verifications < 0.30.9, >= 0.31.0.rc1, < 0.31.5, >= 0.32.0.rc1, < 0.32.0

Identifiers

CVE-2026-45378
GHSA-3mvf-82qp-8qh5

Timeline

2026-07-13: advisory: GitHub Advisory published
2026-07-13: patched: Fixes released in versions 0.30.9, 0.31.5, and 0.32.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.