GHSA-86FH-W43W-338C Decidim: Verification admins can access supplied IDs from other organizations

Description The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant. Technical description The verification admin controllers loads pendingauthorizationid with a raw Authorization.find... and then authorizes the record without...

PT-2026-58954

Description The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant. Technical description The verification admin controllers loads pending authorization id with a raw Authorization.find... and then authorizes the record without...

CVE-2025-59686: Improper Authorization

Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...

A Massive Vaccine Database Leak Exposes IDs of Millions of Indians

Personal information, including ID documents and phone numbers, have been released on Telegram...