Most recent entries from all

EUVD-2026-349344

fkie_cve-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

GHSA-3mvf-82qp-8qh5 — Decidim: Verification documents can be downloaded through reusable links

Affected: RubyGems: decidim-verifications

## Description

Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed `/rails/active_storage/disk/` URLs that can be fetched without any authenticated session.

Anyone who obtains one of those URLs can retrieve the document until the signature expires.

## Technical description

This issue comes from the verification admin UI exposing scanned documents through reusable Active Storage disk links. Verification-document images are rendered with `variant_url(...)`, which produces signed `/rails/active_storage/disk/...` links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period.

The affected files are `verification_attachment` blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views.

Reproduction steps:

1. Create a fresh verification document as a normal user. 1.1. Open http://localhost:3001/users/sign_in. 1.2. Open http://localhost:3001/id_documents/authorizations/new. 1.3. Submit an id_documents verification request with an image attachment.

2. Open the admin review page that renders the attachment. 2.1. Sign out. 2.2. Sign back in as admin@example.org. 2.3. Try http://localhost:3001/admin/id_documents.

3. Harvest the signed Active Storage URL. 3.1. Open D…