Sensitive Data Exposure

Decidim and Decidim-meetings is vulnerable to Sensitive Data Exposure. The vulnerability is due to using a third party library Ransack which allows filtering data on all attributes and associations. This allows an attacker to exfiltrate non-public data from underlying database by traversing association chains from the searchable data class to sensitive attributes of the another class used in the application.