https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:00:21.581154+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42303 CVE-2026-42303 — Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection 2026-10-04T11:00:21.582810+00:00

Affected: ethyca fides

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

 https://cve.radiocsirt.org/vuln/ghsa-qx5f-ghc2-7g5c GHSA-qx5f-ghc2-7g5c — Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection 2026-10-04T11:00:21.582862+00:00

Affected: PyPI: ethyca-fides

### Summary

Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment.

A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.

### Am I affected?

This vulnerability only affects deployments that use Fides's privacy request (data subject request) features, also known collectively as "Lethe". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.

Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:

- `subject_identity_verification_required` - `privacy_request_duplicate_detection.enabled`

Both settings default to `false`.

Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:

1. **Admin UI / configuration API** - stored in the application database and applied at runtime 2. **Environment variables** - read at webse…