CVE-2026-45330 Decidim: Verification admins can access supplied IDs from other organisations

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming currentorganization ownership, allowing an...

Operation on a Resource after Expiration or Release

Overview Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to the password reset functionality. An attacker can accept an invitation for an unlimited amount of time by exploiting the lack of validation for the pending invitation's expiry...

CVE-2023-48220

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the "deviseinvitable" gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable...

PT-2024-13556 · Rubygems +2 · Devise Invitable +3

Name of the Vulnerable Software and Affected Versions: decidim versions 0.0.1.alpha3 through 0.26.8 decidim-admin versions 0.0.1.alpha3 through 0.26.8 decidim-system versions 0.0.1.alpha3 through 0.26.8 devise invitable versions 0.4.rc3 through 2.0.8 Description: The invites feature in the devise...