CVE-2025-65017: 
Ruby vulnerability analysis and mitigation

CVE-2025-65017 is a data leakage vulnerability in Decidim, an open-source participatory democracy framework written in Ruby. The flaw affects versions 0.30.0 through 0.30.3 and 0.31.0.rc1 through 0.31.0.rc2, where UUID collisions in the private data export feature can cause one user's exported data to be served to another user. The vulnerability was introduced by pull request #13571 (merged November 2024) and publicly disclosed on February 3, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.2 (High) (Github Advisory, Decidim Advisory).

The root cause (CWE-200, CWE-703) lies in how Decidim::PrivateExport uses ActiveStorage to attach export files: the active_storage_attachments table stores record_id as a bigint, causing UUID values to be implicitly converted via .to_i. When a UUID begins with numeric characters (e.g., 0210ae70-...), the truncated integer representation can collide with another user's export record ID, causing the wrong file to be associated with the requesting user's export. The theoretical collision probability is approximately 2.3% (roughly 23 per 1,000 users), making accidental cross-user data exposure a realistic risk in active deployments. No special attacker skill is required beyond having a low-privilege authenticated account and triggering a private data export (Github Advisory, Decidim Advisory).

Successful exploitation results in unauthorized disclosure of another user's private export data — typically a ZIP archive containing personal information submitted through the platform (e.g., participation history, personal details). The impact is purely a confidentiality breach with no integrity or availability consequences. Because Decidim is used by governments and civic organizations to manage citizen participation data, exposure of private exports could constitute a significant privacy violation, potentially affecting sensitive personal data of platform participants (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is probabilistic rather than deterministic — an attacker cannot reliably force a collision without controlling UUID generation, making targeted exploitation difficult. The EPSS score is approximately 0.054% (17th percentile), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Feedly).

Upgrade Decidim to version 0.30.4 (for the 0.30.x branch) or 0.31.0 (for the 0.31.x branch), which resolve the UUID collision issue. As part of the upgrade, administrators must run the rake task bin/rails decidim:upgrade:clean:remove_private_exports_attachments to expire all previously generated private export files that may be affected by the bug. If immediate patching is not possible, the recommended workaround is to fully disable the private data exports feature to prevent any cross-user data leakage (Decidim v0.30.4 Release, Decidim v0.31.0 Release, Github Advisory).

The vulnerability was reported by security researcher ahukkanen and published by Decidim maintainer alecslupu on February 3, 2026. The Decidim project followed a coordinated disclosure approach, releasing patched versions (0.30.4 and 0.31.0) in November 2025 with a two-month embargo before public disclosure. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database tracking (Decidim Advisory).