PT-2026-58954 · Rubygems · Decidim-Verifications
Publicado
2026-07-13
·
Atualizado
2026-07-13
CVSS v3.1
4.9
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Description
The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant.
Technical description
The verification admin controllers loads pending authorization id with a raw
Authorization.find(...) and then authorizes the record without checking whether it belongs to current organization.Reproduction steps:
- An org2 participant uploads their ID:
- An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g
http://localhost:3001/admin/id documents/pending authorizations/35/confirmations/new
- The admin then approves this request by looking up the ID in the picture (not shown in this image, but a real ID would expose this)
- Now the request has been approved, which can be seen from the org2 participant authorizations page:
Impact
A tenant admin can access, reject or approve another tenant's
id documents requests.Patches
Workarounds
Disable the "Identity documents" verification
Reference
OWASP A01:2021 Broken Access Control
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Decidim-Verifications