Skip to content

Commit d13b637

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@32a64d0 
1 parent bd04d1b commit d13b637

9 files changed

Lines changed: 512 additions & 0 deletions

‎advisories/_posts/2026-07-13-CVE-2026-45086.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45086 (decidim-demographics): Decidim - Forms admin question editor
4+
lacks authorization'
5+
comments: false
6+
categories:
7+
- decidim-demographics
8+
advisory:
9+
gem: decidim-demographics
10+
cve: 2026-45086
11+
ghsa: vq6j-hj8w-7v39
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45086
13+
title: Decidim - Forms admin question editor lacks authorization
14+
date: 2026-07-13
15+
description: |-
16+
## Description
17+
18+
A participant can load the demographics questionnaire admin editor
19+
and make changes.
20+
21+
## Impact
22+
23+
- Low-privilege users can access questionnaire-admin interfaces.
24+
- They can read question-management surfaces that should remain
25+
limited to questionnaire managers.
26+
27+
## Credits
28+
29+
This issue was discovered in a security audit organized by the
30+
[Decidim Association](https://decidim.org) and made by
31+
[Radically Open Security](https://www.radicallyopensecurity.com/)
32+
against Decidim financed by [NGI](https://ngi.eu/).
33+
cvss_v3: 5.4
34+
unaffected_versions:
35+
- "< 0.31.0"
36+
patched_versions:
37+
- "~> 0.31.5"
38+
- ">= 0.32.0"
39+
related:
40+
url:
41+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45086
42+
- https://rubygems.org/gems/decidim-core/versions/0.32.0
43+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
44+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
45+
- https://github.com/decidim/decidim/pull/16665
46+
- https://advisories.gitlab.com/gem/decidim-demographics/CVE-2026-45086
47+
- https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39
48+
- https://github.com/advisories/GHSA-vq6j-hj8w-7v39
49+
notes: |
50+
- CVE is reserved, but not published.
51+
- cvss_v3 value came from GHSA.
52+
---

‎advisories/_posts/2026-07-13-CVE-2026-45330.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45330 (decidim-verifications): Decidim - Verification admins can
4+
access supplied IDs from other organizations'
5+
comments: false
6+
categories:
7+
- decidim-verifications
8+
advisory:
9+
gem: decidim-verifications
10+
cve: 2026-45330
11+
ghsa: 86fh-w43w-338c
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45330
13+
title: Decidim - Verification admins can access supplied IDs from other organizations
14+
date: 2026-07-13
15+
description: |-
16+
## Description
17+
18+
The verification admin mutation flow allows accessing, verifying,
19+
and rejecting participants records from another tenant.
20+
21+
## Impact
22+
23+
A tenant admin can access, reject or approve another tenant's
24+
`id_documents` requests.
25+
26+
## Credits
27+
28+
This issue was discovered in a security audit organized by the
29+
[Decidim Association](https://decidim.org) and made by
30+
[Radically Open Security](https://www.radicallyopensecurity.com/)
31+
against Decidim financed by [NGI](https://ngi.eu/).
32+
cvss_v3: 4.9
33+
patched_versions:
34+
- "~> 0.30.9"
35+
- "~> 0.31.5"
36+
- ">= 0.32.0"
37+
related:
38+
url:
39+
- https://rubygems.org/gems/decidim-verifications/versions/0.32.0
40+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
41+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
42+
- https://github.com/decidim/decidim/releases/tag/v0.30.9
43+
- https://github.com/decidim/decidim/pull/16666
44+
- https://advisories.gitlab.com/gem/decidim-verifications/CVE-2026-45330
45+
- https://github.com/decidim/decidim/security/advisories/GHSA-86fh-w43w-338c
46+
- https://github.com/advisories/GHSA-86fh-w43w-338c
47+
---

‎advisories/_posts/2026-07-13-CVE-2026-45376.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45376 (decidim-admin): Decidim - Admin user search allows SQL injection
4+
through similarity-based sorting'
5+
comments: false
6+
categories:
7+
- decidim-admin
8+
advisory:
9+
gem: decidim-admin
10+
cve: 2026-45376
11+
ghsa: jvqq-cvh4-xm37
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45376
13+
title: Decidim - Admin user search allows SQL injection through similarity-based
14+
sorting
15+
date: 2026-07-13
16+
description: |-
17+
## Description
18+
19+
The admin organization user search uses the untrusted term value inside
20+
raw SQL ORDER BY expressions. Because the value is interpolated before
21+
Rails sanitization is applied, a crafted search string is executed by
22+
PostgreSQL as part of the sort expression.
23+
24+
## Impact
25+
26+
- Exploitation requires an authenticated admin session, which limits
27+
exposure but does not remove the underlying SQL injection risk.
28+
- An authenticated admin can inject arbitrary SQL expressions into
29+
the query's `ORDER BY` clause and use timing differences as a
30+
blind SQL oracle.
31+
- The injection happens inside a database expression, so the effect
32+
is not inherently limited to sorting the current organization user
33+
relation. Depending on the privileges of the application's
34+
PostgreSQL role, an attacker may be able to infer data from other
35+
tables readable by that role.
36+
- The issue remains exploitable even without verbose database errors
37+
because time-based payloads such as `pg_sleep` provide a reliable
38+
blind side channel.
39+
- Repeated long-running payloads can also be used to degrade availability
40+
by tying up database-backed requests.
41+
42+
## Credits
43+
44+
This issue was discovered in a security audit organized by the
45+
[Decidim Association](https://decidim.org) and made by
46+
[Radically Open Security](https://www.radicallyopensecurity.com/)
47+
against Decidim financed by [NGI](https://ngi.eu/).
48+
cvss_v3: 6.8
49+
patched_versions:
50+
- "~> 0.30.9"
51+
- "~> 0.31.5"
52+
- ">= 0.32.0"
53+
related:
54+
url:
55+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45376
56+
- https://rubygems.org/gems/decidim-admin/versions/0.32.0
57+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
58+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
59+
- https://github.com/decidim/decidim/releases/tag/v0.30.9
60+
- https://github.com/decidim/decidim/pull/16668
61+
- https://advisories.gitlab.com/gem/decidim-admin/CVE-2026-45376
62+
- https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37
63+
- https://github.com/advisories/GHSA-jvqq-cvh4-xm37
64+
notes: |
65+
- CVE is reserved, but not published.
66+
- cvss_v3 value came from GHSA.
67+
---

‎advisories/_posts/2026-07-13-CVE-2026-45377.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45377 (decidim-core): Decidim - Private exports can be downloaded
4+
through reusable links'
5+
comments: false
6+
categories:
7+
- decidim-core
8+
advisory:
9+
gem: decidim-core
10+
cve: 2026-45377
11+
ghsa: 767h-63j4-5226
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45377
13+
title: Decidim - Private exports can be downloaded through reusable links
14+
date: 2026-07-13
15+
description: |-
16+
## Description
17+
18+
The normal `download_your_data` flow requires the requester to be
19+
logged in as the export owner, but the resulting Active Storage blob
20+
redirect URL can be replayed without authentication by anyone who obtains it.
21+
22+
## Impact
23+
24+
Personal data exports can be retrieved through leakage channels such
25+
as browser history, logs, referrers, screenshots, copied links, support
26+
transcripts, intercepted email content, or other client-side disclosure
27+
of the GET URL.
28+
29+
## Credits
30+
31+
This issue was discovered in a security audit organized by the
32+
[Decidim Association](https://decidim.org) and made by
33+
[Radically Open Security](https://www.radicallyopensecurity.com/)
34+
against Decidim financed by [NGI](https://ngi.eu/).
35+
cvss_v3: 6.5
36+
patched_versions:
37+
- "~> 0.30.9"
38+
- "~> 0.31.5"
39+
- ">= 0.32.0"
40+
related:
41+
url:
42+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45377
43+
- https://rubygems.org/gems/decidim-core/versions/0.32.0
44+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
45+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
46+
- https://github.com/decidim/decidim/releases/tag/v0.30.9
47+
- https://github.com/decidim/decidim/pull/16680
48+
- https://advisories.gitlab.com/gem/decidim-core/CVE-2026-45377
49+
- https://github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226
50+
- https://github.com/advisories/GHSA-767h-63j4-5226
51+
notes: |
52+
- CVE is reserved, but not published.
53+
- cvss_v3 value came from GHSA.
54+
---

‎advisories/_posts/2026-07-13-CVE-2026-45378.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45378 (decidim-verifications): Decidim - Verification documents can
4+
be downloaded through reusable links'
5+
comments: false
6+
categories:
7+
- decidim-verifications
8+
advisory:
9+
gem: decidim-verifications
10+
cve: 2026-45378
11+
ghsa: 3mvf-82qp-8qh5
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45378
13+
title: Decidim - Verification documents can be downloaded through reusable links
14+
date: 2026-07-13
15+
description: |-
16+
## Description
17+
18+
Scanned identity-document images provided by participants and shown
19+
in the verification admin workflow are exposed through signed
20+
`/rails/active_storage/disk/` URLs that can be fetched without any
21+
authenticated session.
22+
23+
Anyone who obtains one of those URLs can retrieve the document until
24+
the signature expires.
25+
26+
## Impact
27+
28+
- This only applies to Organizations using the \"Identity documents\"
29+
verification
30+
- Any party that obtains one of these URLs can download the underlying
31+
scanned identity document for the lifetime of the signed link without needing to
32+
authenticate as the reviewing admin.
33+
- In the reproduced case, that replay window was about seven days,
34+
which is long enough for routine leakage channels such as copied links,
35+
screenshots, logs, browser history, and support workflows to become
36+
realistic exfiltration paths.
37+
- This raises the risk of leakage through browser history, screenshots,
38+
copy-paste, support tickets, logs, analytics tooling, malicious
39+
browser extensions, or any other channel that captures full URLs.
40+
- Because the affected files are identity-verification documents, the
41+
exposed data can include highly sensitive personal information.
42+
43+
## Credits
44+
45+
This issue was discovered in a security audit organized by the
46+
[Decidim Association](https://decidim.org) and made by
47+
[Radically Open Security](https://www.radicallyopensecurity.com/)
48+
against Decidim financed by [NGI](https://ngi.eu/).
49+
cvss_v3: 7.5
50+
patched_versions:
51+
- "~> 0.30.9"
52+
- "~> 0.31.5"
53+
- ">= 0.32.0"
54+
related:
55+
url:
56+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45378
57+
- https://rubygems.org/gems/decidim-core/versions/0.32.0
58+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
59+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
60+
- https://github.com/decidim/decidim/releases/tag/v0.30.9
61+
- https://github.com/decidim/decidim/pull/16680
62+
- https://advisories.gitlab.com/gem/decidim-verifications/CVE-2026-45378
63+
- https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5
64+
- https://github.com/advisories/GHSA-3mvf-82qp-8qh5
65+
notes: |
66+
- CVE is reserved, but not published.
67+
- cvss_v3 value came from GHSA.
68+
---

‎advisories/_posts/2026-07-13-CVE-2026-45414.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-45414 (decidim): Decidim - JWT-backed authentication can be replayed
4+
across organizations'
5+
comments: false
6+
categories:
7+
- decidim
8+
advisory:
9+
gem: decidim
10+
cve: 2026-45414
11+
ghsa: r3v7-5x4c-c69q
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45414
13+
title: Decidim - JWT-backed authentication can be replayed across organizations
14+
date: 2026-07-13
15+
description: |-
16+
## Description
17+
18+
A JWT issued to an Org 1 account is accepted on the Org 2 API and can
19+
read the admin-only GraphQL `participantDetails` field for an Org 2
20+
participant. The same trust-boundary problem also affects API-user
21+
authentication: an Org 1 API user can use a JWT on the Org 1 host
22+
and replay that JWT to the Org 2 API to read Org 2 participant
23+
personal data and reach Org 2's `proposal.answer` mutation path.
24+
25+
## Impact
26+
27+
A JWT issued for one organization can be replayed successfully against
28+
another organization's API and used to retrieve sensitive details from
29+
that organization.
30+
31+
## Credits
32+
33+
This issue was discovered in a security audit organized by the
34+
[Decidim Association](https://decidim.org) and made by
35+
[Radically Open Security](https://www.radicallyopensecurity.com/)
36+
against Decidim financed by [NGI](https://ngi.eu/).
37+
cvss_v3: 8.5
38+
patched_versions:
39+
- "~> 0.31.5"
40+
- ">= 0.32.0"
41+
related:
42+
url:
43+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45414
44+
- https://rubygems.org/gems/decidim-core/versions/0.32.0
45+
- https://github.com/decidim/decidim/releases/tag/v0.32.0
46+
- https://github.com/decidim/decidim/releases/tag/v0.31.5
47+
- https://github.com/decidim/decidim/pull/16673
48+
- https://github.com/decidim/decidim/pull/16756
49+
- https://advisories.gitlab.com/gem/decidim/CVE-2026-45414
50+
- https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
51+
- https://github.com/advisories/GHSA-r3v7-5x4c-c69q
52+
notes: |
53+
- CVE is reserved, but not published.
54+
- cvss_v3 value came from GHSA.
55+
---

0 commit comments

Comments
 (0)