https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 18:52:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317425 EUVD-2026-317425 https://cve.radiocsirt.org/vuln/euvd-2026-317425 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42303 <p>Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.</p> <p>Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42303 https://cve.radiocsirt.org/vuln/ghsa-qx5f-ghc2-7g5c <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment.</p> <p>A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.</p> <p>### Am I affected?</p> <p>This vulnerability only affects deployments that use Fides&#39;s privacy request (data subject request) features, also known collectively as &#34;Lethe&#34;. Deployments that do not submit, process, or manage privacy requests through Fides are not affected.</p> <p>Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:</p> <p>- `subject_identity_verification_required` - `privacy_request_duplicate_detection.enabled`</p> <p>Both settings default to `false`.</p> <p>Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:</p> <p>1. **Admin UI / configuration API** - stored in the application database and applied at runtime 2. **Environment variables** - read at webse…</p> <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment.</p> <p>A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.</p> <p>### Am I affected?</p> <p>This vulnerability only affects deployments that use Fides&#39;s privacy request (data subject request) features, also known collectively as &#34;Lethe&#34;. Deployments that do not submit, process, or manage privacy requests through Fides are not affected.</p> <p>Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:</p> <p>- `subject_identity_verification_required` - `privacy_request_duplicate_detection.enabled`</p> <p>Both settings default to `false`.</p> <p>Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:</p> <p>1. **Admin UI / configuration API** - stored in the application database and applied at runtime 2. **Environment variables** - read at webse…</p> https://cve.radiocsirt.org/vuln/ghsa-qx5f-ghc2-7g5c https://cve.radiocsirt.org/vuln/pysec-2026-2471 <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment.</p> <p>A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.</p> <p>### Am I affected?</p> <p>This vulnerability only affects deployments that use Fides&#39;s privacy request (data subject request) features, also known collectively as &#34;Lethe&#34;. Deployments that do not submit, process, or manage privacy requests through Fides are not affected.</p> <p>Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:</p> <p>- `subject_identity_verification_required` - `privacy_request_duplicate_detection.enabled`</p> <p>Both settings default to `false`.</p> <p>Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:</p> <p>1. **Admin UI / configuration API** - stored in the application database and applied at runtime 2. **Environment variables** - read at webse…</p> <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject&#39;s records across every integration configured in the affected deployment.</p> <p>A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.</p> <p>### Am I affected?</p> <p>This vulnerability only affects deployments that use Fides&#39;s privacy request (data subject request) features, also known collectively as &#34;Lethe&#34;. Deployments that do not submit, process, or manage privacy requests through Fides are not affected.</p> <p>Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:</p> <p>- `subject_identity_verification_required` - `privacy_request_duplicate_detection.enabled`</p> <p>Both settings default to `false`.</p> <p>Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:</p> <p>1. **Admin UI / configuration API** - stored in the application database and applied at runtime 2. **Environment variables** - read at webse…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2471