Lucene search
+L

7 matches found

NVD
NVD
added 2026/08/06 10:17 p.m.11 views

CVE-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

7.5CVSS0.00303EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 8:15 p.m.74 views

CVE-2026-45378

CVE-2026-45378 affects Decidim where the identity-document verification admin UI embeds verification_attachment blobs using reusable signed Active Storage disk URLs. The implementation renders images with variant_url(...), producing signed /rails/active_storage/disk/... links that bypass authoriz...

7.5CVSS5.4AI score0.00303EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/06 8:15 p.m.13 views

CVE-2026-45378 Decidim: Verification documents can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

7.5CVSS5.4AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/06 8:15 p.m.29 views

CVE-2026-45378 Decidim: Verification documents can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

7.5CVSS0.00303EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/13 5:10 p.m.19 views

GHSA-3MVF-82QP-8QH5 Decidim: Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

7.5CVSS6.1AI score0.00303EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/07/13 5:10 p.m.16 views

Decidim: Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

7.5CVSS6.1AI score0.00303EPSS
SaveExploits0References3Affected Software1
Hacker One
Hacker One
added 2015/07/15 10:19 p.m.34 views

Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

6.9AI score
SaveExploits0
Rows per page
Query Builder