CVE-2026-45414

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.31.5 Decidim version 0.32.0.rc1

Description JWT-backed API authentication is not sufficiently bound to the organization selected by the current host. This allows a JSON Web Token (JWT), which is a compact, URL-safe means of representing claims to be transferred between two parties, issued for one tenant to be replayed against another tenant's API. An attacker can use a JWT from one organization to access the API of another organization to read sensitive participantDetails data via GraphQL and reach the proposal.answer mutation path.

Recommendations Update to version 0.31.5 or later. Update to version 0.32.0.rc2 or later. As a temporary workaround, disable JWT credentials on the system panel (/system).