CVE-2026-45330: Decidim Auth Bypass Vulnerability

CVE-2026-45330 Overview

CVE-2026-45330 is an insecure direct object reference (IDOR) vulnerability [CWE-639] in Decidim, an open-source participatory democracy framework. The identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership. An administrator authenticated to one tenant can view, approve, or reject identity-document verification requests belonging to another tenant. The flaw affects Decidim versions prior to 0.30.9, from 0.31.0 before 0.31.5, and version 0.32.0.rc1. Maintainers released fixes in 0.30.9, 0.31.5, and 0.32.0.rc2.

Critical Impact
A privileged administrator in one Decidim tenant can access, approve, or reject identity-document verification requests submitted by users of another tenant, exposing personally identifiable information (PII) contained in submitted ID documents.

Affected Products

Decidim versions prior to 0.30.9
Decidim versions 0.31.0 through 0.31.4
Decidim version 0.32.0.rc1

Discovery Timeline

2026-07-31 - CVE-2026-45330 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-45330

Vulnerability Analysis

Decidim supports multi-tenant deployments where each tenant represents an isolated Organization. Users submit identity documents for verification, and tenant administrators review and approve those submissions. The identity-document verification admin controllers retrieve pending Authorization records using the raw primary key from request parameters. The controllers omit a scoping check against current_organization, so any authenticated administrator can substitute an arbitrary record identifier and act on requests owned by a different tenant.

The issue falls under CWE-639: Authorization Bypass Through User-Controlled Key. Exploitation requires authenticated administrator privileges, which limits the attacker population but does not prevent lateral abuse across tenants sharing the same Decidim installation.

Root Cause

The admin controllers responsible for identity-document verification look up Authorization records directly by identifier without applying an Organization-scoped query filter. Access control relies on the presence of an admin role rather than verifying that the target record belongs to the acting administrator's tenant. In a shared-hosting or federated Decidim deployment, this omission collapses the boundary between organizations.

Attack Vector

An authenticated administrator of Tenant A crafts a request to the identity-document verification admin endpoint, substituting the id parameter with a value corresponding to a pending Authorization in Tenant B. Because the controller does not filter by current_organization, the record loads successfully and the administrator can view the submitted ID document or invoke approve or reject actions. The attack requires no user interaction from the victim tenant and does not require additional privileges beyond an administrator account on any tenant.

Refer to the GitHub Security Advisory GHSA-86fh-w43w-338c for the maintainer analysis.

Detection Methods for CVE-2026-45330

Indicators of Compromise

Admin actions on Authorization records where the record's organization_id does not match the acting administrator's current_organization.
Approve or reject events on identity-document verification records originating from an administrator not associated with the record's tenant.
Unexpected access to identity-document files or attachments by administrators outside the owning organization.

Detection Strategies

Audit application logs for admin verification controller requests and correlate the admin_user.organization_id with the authorization.organization_id on the targeted record.
Compare historical Decidim admin action logs against tenant ownership to identify cross-tenant approvals or rejections performed before patching.
Enable Rails request logging with parameter capture on identity-document verification routes and flag any deviation between admin tenant and record tenant.

Monitoring Recommendations

Monitor Decidim::Verifications::IdDocuments admin routes for anomalous request patterns, including sequential access to varying record identifiers.
Alert on any administrator account performing verification actions outside a defined baseline of expected tenants.
Retain admin audit trails for the full retention period required to support post-patch forensic review of prior cross-tenant activity.

How to Mitigate CVE-2026-45330

Immediate Actions Required

Upgrade Decidim to 0.30.9, 0.31.5, or 0.32.0.rc2 depending on the deployed release line.
Review admin audit logs for prior cross-tenant access to identity-document verification records and notify affected users if PII exposure is identified.
Restrict administrator account provisioning and re-verify the trust boundary of every administrator in multi-tenant Decidim installations.

Patch Information

The Decidim maintainers released fixes in the following versions:

The patches scope Authorization record lookups in the identity-document verification admin controllers to current_organization, blocking cross-tenant record access.

Workarounds

If immediate upgrade is not feasible, temporarily disable the identity-document verification handler in the Decidim admin configuration until the patched version is deployed.
Reduce the number of administrator accounts and limit administrator privileges to the minimum tenants each operator requires.
Place the Decidim admin interface behind network-level access controls to constrain which operators can reach the vulnerable endpoints.

bash

# Upgrade Decidim via Bundler to a patched release
bundle update decidim --conservative
# Verify the installed version
bundle info decidim | grep -i version
# Restart the application server after upgrade
bin/rails restart