CVE-2026-45414: 
Ruby 脆弱性の分析と軽減

CVE-2026-45414 is a JWT authentication replay vulnerability in Decidim, an open-source participatory democracy platform, that allows an authenticated user of one organization (tenant) to replay their JWT against another organization's API. The flaw affects Decidim versions prior to 0.31.5 and 0.32.0 (RubyGems package). It was discovered through a security audit organized by the Decidim Association and conducted by Radically Open Security, financed by NGI, and publicly disclosed on July 13, 2026. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory, Decidim Advisory).

The root cause is improper authentication (CWE-287): Decidim's JWT-backed API authentication uses the HTTP Host header to select the organization context, but does not bind the JWT's authenticated principal to that specific organization. This means a JWT issued for Org 1 can be replayed against Org 2's API endpoint simply by changing the Host header to org2.localhost:3001, and the API will process the request in Org 2's context while trusting the Org 1 principal. The vulnerability affects both admin-issued API-key JWTs and session JWTs obtained at login, enabling access to the admin-only GraphQL participantDetails field and the proposal.answer mutation path of the target organization. The fix, implemented in PRs #16673 and #16756, scopes API authentication lookups by decidim_organization_id and validates that the authenticated user's organization matches current_organization before returning session data (GitHub Advisory, PR #16673, PR #16756).

Successful exploitation allows an attacker with a valid JWT for any one Decidim organization to read sensitive personal data — including admin-only participantDetails — belonging to participants of other organizations hosted on the same multi-tenant instance. Additionally, the attacker can reach the proposal.answer mutation path of the target organization, enabling limited data manipulation (low integrity impact). Availability is not affected, but the confidentiality breach crosses tenant boundaries, making this a significant data isolation failure in multi-organization deployments (GitHub Advisory, Decidim Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires low privileges (a valid JWT for any organization on the instance) and no user interaction, and is exploitable remotely over the network with low attack complexity. The CVE status was listed as "Reserved" at time of Feedly ingestion, and it does not appear in the CISA KEV catalog. No EPSS score or threat actor attribution is currently available (GitHub Advisory).

1. Obtain a JWT: Authenticate to Org 1's Decidim API using an admin-issued API key (from the system panel at /system) or by logging in as an organization admin and capturing the JWT returned in the response.
2. Identify target organization: Enumerate other organizations hosted on the same Decidim instance (e.g., org2.example.com) by inspecting known hostnames or DNS records.
3. Replay JWT to target org: Send a GraphQL API request to the target organization's API endpoint, substituting the Host header with the target organization's hostname (e.g., Host: org2.example.com) while including the Org 1 JWT in the Authorization header.
4. Query sensitive data: Issue a GraphQL query for the admin-only participantDetails field to retrieve personal data of Org 2 participants, or invoke the proposal.answer mutation to interact with Org 2's proposals.
5. Exfiltrate or manipulate data: Collect the returned participant personal data or submit answers to proposals, achieving unauthorized cross-tenant data access and limited data manipulation (GitHub Advisory, PR #16673).

• Network: GraphQL API requests (typically POST /api) to a Decidim host where the Host header does not match the organization associated with the Authorization JWT bearer token; requests originating from an IP address associated with a different tenant's users.
• Logs: API access logs showing successful GraphQL responses to participantDetails queries or proposal.answer mutations from users whose JWT decidim_organization_id does not match the target host's organization ID; repeated cross-host API requests with the same JWT value.
• Application Behavior: Admin-only GraphQL fields (participantDetails) returning data in response to requests authenticated with non-admin or cross-organization tokens; proposal.answer mutations executed by principals not belonging to the target organization.

Upgrade Decidim to version 0.31.5 or 0.32.0, which contain the fixes from PRs #16673 and #16756 that bind JWT authentication to the current organization context. For deployments that cannot immediately upgrade, the official workaround is to disable JWT credentials via the system administration panel at /system. Operators should also review API access logs for anomalous cross-organization requests as a precautionary measure (GitHub Advisory, Decidim Advisory).

The vulnerability was discovered through a formal security audit organized by the Decidim Association and performed by Radically Open Security, funded by NGI, indicating a proactive security posture by the project. The advisory credits this structured audit process and references OWASP A01:2021 (Broken Access Control) as the relevant standard. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and associated pull requests (Decidim Advisory).