CVE-2026-42303: Fides Auth Bypass Vulnerability

CVE-2026-42303 Overview

CVE-2026-42303 affects Fides, an open-source privacy engineering platform maintained by Ethyca. Versions from 2.75.0 to before 2.83.2 contain an authentication bypass [CWE-288] in the privacy request workflow. When a deployment enables both subject identity verification and duplicate privacy request detection, an administrator can approve a privacy request whose identity was never verified. For erasure policies, this allows unauthorized deletion of a data subject's records across every integration configured in the affected deployment. The vendor released a fix in version 2.83.2.

Critical Impact
Administrators can approve unverified privacy requests, enabling unauthorized data erasure across all configured integrations in vulnerable Fides deployments.

Affected Products

Ethyca Fides versions 2.75.0 through 2.83.1
Fides deployments with subject identity verification enabled
Fides deployments with duplicate privacy request detection enabled

Discovery Timeline

2026-05-12 - CVE-2026-42303 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42303

Vulnerability Analysis

The flaw resides in the interaction between Fides's identity verification flow and its duplicate privacy request detection logic. When a data subject submits a privacy request, Fides assigns it a status of identity_unverified until the subject confirms ownership through a verification code. If duplicate detection identifies the request as a duplicate of an existing one, the request transitions to a duplicate state without completing identity verification. The pre-patch approval logic does not re-check verification state for duplicate requests, allowing an administrator to approve a request that bypassed the identity proof step.

For erasure policies, approval triggers deletion of the named subject's records across all configured downstream integrations. An attacker who can submit privacy requests targeting another individual's identifiers can therefore induce destruction of that person's data once an administrator approves the request.

Root Cause

The defect is a missing authentication check [CWE-288] in the privacy request state machine. The verify_identity method in src/fides/api/models/privacy_request/privacy_request.py previously rejected any request not in the identity_unverified state, which excluded duplicate-state requests from completing verification. The administrative approval path did not enforce that identity_verified_at was populated before processing erasure actions.

Attack Vector

Exploitation requires an attacker to submit a privacy request that collides with an existing one to trigger duplicate detection, then rely on administrator action to approve the unverified request. The administrator UI did not block approval of duplicates lacking verification, so social engineering or routine queue processing completes the chain.

python

# Patch excerpt: src/fides/api/models/privacy_request/privacy_request.py
def verify_identity(self, db: Session, provided_code: str) -> "PrivacyRequest":
    """Verify the identification code supplied by the user.

    If verified, change the status to "pending" and set identity_verified_at.
    Duplicate requests are allowed to verify — they transition to "pending"
    so that handle_approval can re-evaluate duplicate detection with the
    fresh identity_verified_at timestamp (the first-verified request in a
    duplicate group becomes canonical).
    """
    if self.status not in (
        PrivacyRequestStatus.identity_unverified,
        PrivacyRequestStatus.duplicate,
    ):
        raise IdentityVerificationException(
            f"Invalid identity verification request. Privacy request '{self.id}' status = {self.status.value}."
        )

Source: GitHub Commit 0e320b2

Detection Methods for CVE-2026-42303

Indicators of Compromise

Privacy requests in complete or approved state with a null identity_verified_at timestamp
Erasure executions triggered against integrations for subjects who never received or responded to a verification email
Privacy request audit logs showing approval events for requests previously marked with the duplicate status

Detection Strategies

Query the Fides database for approved privacy requests where identity_verified_at IS NULL and policy type is erasure
Correlate administrator approval events with the absence of preceding identity verification events for the same privacy_request_id
Review integration execution logs for deletions tied to privacy requests originating from duplicate-detection collisions

Monitoring Recommendations

Alert on any erasure-policy privacy request approved without a corresponding identity verification record
Track Fides version inventory and flag instances running between 2.75.0 and 2.83.1
Monitor administrator accounts for unusual approval volume on duplicate-flagged requests

How to Mitigate CVE-2026-42303

Immediate Actions Required

Upgrade all Fides deployments to version 2.83.2 or later
Audit privacy request history for erasure approvals lacking verified identities and notify affected data subjects
Temporarily disable automated approval workflows for duplicate-flagged requests until the upgrade is applied

Patch Information

The issue is fixed in Fides 2.83.2. The fix consists of two changes: the backend update in pull request #7971 allows duplicate-state requests to complete identity verification, and the admin UI update in pull request #7972 blocks approval of unverified duplicate requests. Full release notes are available in Fides Release v2.83.2 and the GitHub Security Advisory GHSA-qx5f-ghc2-7g5c.

Workarounds

Disable duplicate privacy request detection until upgrading, accepting the operational tradeoff of processing duplicates manually
Disable subject identity verification only if duplicate detection cannot be disabled, recognizing this weakens overall privacy controls
Require manual verification confirmation by administrators before approving any privacy request flagged as a duplicate

bash

# Upgrade Fides via pip
pip install --upgrade 'ethyca-fides==2.83.2'

# Or pull the patched container image
docker pull ethyca/fides:2.83.2

# Verify installed version
fides --version