Auth bypass in Decidim
CVE-2026-45414
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Decidim — versions < 0.31.5, >= 0.32.0.rc1, < 0.32.0.rc2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-45414?
- CVE-2026-45414 is a high-severity vulnerability in Decidim, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.5/10. Published 2026-08-06.
- How severe is CVE-2026-45414?
- High severity. CVSS v3 base score is 8.5 out of 10.