CVE-2026-45378

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1

Description The identity-document verification admin UI exposes scanned identity documents through reusable signed Active Storage disk URLs. This occurs because verification-document images are rendered using the variant url(...) function, which generates signed /rails/active storage/disk/... links instead of routing the request through an authorization-checking controller. Since these service URLs remain valid for seven days, the URL itself acts as the credential, allowing anyone who obtains the link to download sensitive personal identity documents without an authenticated session until the signature expires. The affected files are verification attachment blobs on Decidim::Authorization, which are embedded directly into the HTML of admin review pages for pending and confirmation views.

Recommendations Update to version 0.30.9. Update to version 0.31.5. Update to version 0.32.0.rc2. As a temporary workaround, disable the Identity documents verification.