CVE-2026-45377

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1

Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. While the Decidim::DownloadYourDataController#download file function correctly authenticates the export owner, it redirects to a signed Active Storage blob URL that is no longer bound to the user session. This transforms an authenticated, user-scoped download into a reusable bearer link. Because this URL is delivered via a GET request, it is susceptible to leakage through browser history, logs, proxy tooling, or support transcripts, allowing unauthorized parties to retrieve personal data exports.

Recommendations Update to version 0.30.9. Update to version 0.31.5. Update to version 0.32.0.rc2. As a temporary workaround, disable Private Downloads URLs.