CVE-2026-45377: Decidim Information Disclosure Flaw

CVE-2026-45377 Overview

CVE-2026-45377 is an information disclosure vulnerability in Decidim, an open source participatory democracy framework. The flaw resides in the Decidim::DownloadYourDataController#download_file action, which authenticates the export owner but then redirects to a signed Active Storage blob URL that is not bound to the owner session. Anyone who obtains the resulting URL can replay it without authentication and retrieve the exported user data. The issue affects versions prior to 0.30.9, versions 0.31.0 before 0.31.5, and release candidate 0.32.0.rc1 before 0.32.0.rc2. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
An unauthenticated actor who obtains a leaked signed blob URL can download another user's exported personal data without any session or credential check.

Affected Products

Decidim versions prior to 0.30.9
Decidim versions 0.31.0 through 0.31.4
Decidim 0.32.0.rc1

Discovery Timeline

2026-07-31 - CVE-2026-45377 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-45377

Vulnerability Analysis

Decidim allows users to request an export of their personal data through the download_your_data flow. The controller Decidim::DownloadYourDataController#download_file enforces that the requester is logged in as the export owner before serving the file. Instead of streaming the file bytes through an authenticated response, the controller issues an HTTP redirect to a Rails Active Storage signed blob URL. That signed URL grants access to the blob for its validity window based only on the signature, not on any session cookie or user identity.

The consequence is a session-decoupled artifact. Once the signed URL is generated, it can be replayed by any party that observes it, including through browser history, referrer headers, proxy logs, shared links, or accidental disclosure in support tickets. The exported data can contain personally identifiable information (PII) belonging to participants of the democratic platform.

Root Cause

The root cause is a broken authorization boundary between the authenticated controller action and the storage layer. download_file correctly identifies the owner but delegates delivery to Active Storage's public signed URL scheme. The signed URL is stateless and not bound to the owner's session, so authorization is effectively downgraded from session-based to knowledge-of-URL.

Attack Vector

Exploitation requires an attacker to obtain the signed Active Storage URL through any side channel: shared links, HTTP referrer leakage, log ingestion pipelines, browser extensions, or shoulder surfing. User interaction is required to trigger the initial redirect, but no authentication is required to replay the resulting URL. The attacker then issues a direct HTTP GET request to the blob URL and receives the exported data. Technical details are documented in the Decidim GitHub Security Advisory GHSA-767h-63j4-5226 and the corresponding fix in Pull Request #16680.

Detection Methods for CVE-2026-45377

Indicators of Compromise

Requests to Active Storage blob paths (typically under /rails/active_storage/blobs/ or /rails/active_storage/disk/) that originate from IP addresses or user agents that differ from the session that requested the export.
Repeated GET requests to the same signed blob URL from multiple client identifiers within its validity window.
Access to download_your_data export blobs from unauthenticated sessions or from sessions belonging to accounts other than the export owner.

Detection Strategies

Correlate Decidim::DownloadYourDataController#download_file invocations with subsequent Active Storage blob requests and alert when the downstream fetch is unauthenticated or occurs from a new IP or user agent.
Parse web server access logs for Active Storage URLs referencing download_your_data exports and flag responses served without an authenticated session cookie.
Baseline normal export download behavior per user and alert on deviations such as blob retrievals from geolocations or ASNs inconsistent with the owner's typical activity.

Monitoring Recommendations

Enable request-level logging on the reverse proxy and application server for all /rails/active_storage/ endpoints, including client IP, user agent, and referrer.
Ship application and proxy logs to a centralized analytics platform and retain them long enough to investigate replay windows.
Monitor outbound referrer headers and log-forwarding services for accidental exposure of signed URLs containing blobs or disk path segments.

How to Mitigate CVE-2026-45377

Immediate Actions Required

Upgrade Decidim to a fixed release: 0.30.9, 0.31.5, or 0.32.0.rc2.
Invalidate any pending download_your_data export URLs generated prior to the upgrade and require users to regenerate exports.
Audit web server, proxy, and third-party log stores for prior exposure of Active Storage blob URLs tied to data exports.

Patch Information

The maintainers fixed the flaw by ensuring that Decidim::DownloadYourDataController#download_file no longer redirects to an unauthenticated signed blob URL. Instead, the file is delivered through an authenticated response bound to the owner's session. The fix is included in Decidim 0.30.9, 0.31.5, and 0.32.0.rc2. See the upstream patch in Pull Request #16680 for implementation details.

Workarounds

Temporarily disable the download_your_data feature at the organization or admin level until the upgrade is applied.
Reduce the Active Storage signed URL expiration window (Rails.application.config.active_storage.service_urls_expire_in) to minimize the replay window for any URL that leaks.
Restrict access to Active Storage endpoints through the reverse proxy so that authenticated session cookies are required before the blob is served.

bash

# Example: shorten Active Storage signed URL lifetime in Rails config
# config/application.rb
config.active_storage.service_urls_expire_in = 30.seconds