CVE-2026-45330: 
Ruby vulnerability analysis and mitigation

CVE-2026-45330 is a broken access control vulnerability in Decidim's verification admin module that allows a tenant administrator to access, approve, or reject identity document (ID) verification requests belonging to participants of another tenant organization. It was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, and was publicly disclosed on July 13, 2026. Affected versions of the decidim-verifications RubyGems package include all releases before 0.30.9, 0.31.0.rc1 through 0.31.4, and 0.32.0.rc1. It carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Decidim Advisory).

The root cause is an Insecure Direct Object Reference (IDOR) / broken access control flaw (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; OWASP A01:2021) in the verification admin controllers of the decidim-verifications module. Specifically, the controllers load a pending_authorization_id using a raw Authorization.find(...) call without scoping the query to current_organization, meaning any admin can supply an arbitrary authorization ID from another tenant via the URL (e.g., /admin/id_documents/pending_authorizations/35/confirmations/new). The fix introduced a new Rails concern Decidim::Verifications::Admin::PendingAuthorizationLoader that scopes all authorization lookups to the current organization, raising ActiveRecord::RecordNotFound (resulting in a 404) for out-of-scope IDs (GitHub Advisory, Fix PR).

A malicious tenant administrator can view sensitive government-issued identity documents (e.g., national IDs, passports) uploaded by participants of other organizations, and can also approve or reject those participants' verification requests, directly affecting their platform access. This constitutes a high confidentiality impact — exposing personally identifiable information (PII) including ID document images — and an integrity impact through unauthorized approval or rejection of verification records. There is no availability impact, and the scope is limited to the affected Decidim instance's tenant boundary (GitHub Advisory).

1. Gain admin access: Obtain or already possess administrator credentials for any tenant organization (org1) on a shared Decidim multi-tenant instance.
2. Identify target authorization IDs: Browse or enumerate pending authorization IDs from the org1 admin panel. Since IDs are sequential integers, an attacker can increment or decrement the ID to guess records belonging to other tenants.
3. Access cross-tenant ID document: Directly navigate to a URL such as http://<decidim-host>/admin/id_documents/pending_authorizations/<target_id>/confirmations/new, substituting <target_id> with an ID belonging to org2's participant.
4. View sensitive PII: The page renders the org2 participant's uploaded government-issued ID document image, exposing their personal information.
5. Approve or reject the request: Submit the confirmation or rejection form to alter the verification status of the org2 participant, affecting their access rights on the platform (GitHub Advisory, Fix PR).

• Logs: Web server or Rails application logs showing admin requests to /admin/id_documents/pending_authorizations/<id>/confirmations/new or /rejections/new where the <id> does not correspond to any participant within the requesting admin's own organization.
• Logs: Unusual sequences of incrementing or decrementing authorization IDs accessed by the same admin session in a short time window, suggesting enumeration.
• Application Events: Verification approval or rejection events recorded in Decidim's audit log for participants belonging to an organization different from the acting admin's organization.
• Network: HTTP GET/POST requests to /admin/id_documents/pending_authorizations/*/confirmations or /rejections originating from admin sessions authenticated to a different tenant than the resource owner (GitHub Advisory).

Upgrade the decidim-verifications gem to one of the patched versions: 0.30.9, 0.31.5, or 0.32.0. The fix scopes all pending authorization lookups to the current organization, preventing cross-tenant access. As a temporary workaround for instances that cannot immediately upgrade, administrators should disable the "Identity documents" verification feature entirely within the Decidim admin panel (GitHub Advisory, Fix PR).

The vulnerability was discovered through a formal security audit organized by the Decidim Association and performed by Radically Open Security, funded by NGI. The fix was developed with AI-assisted coding (GPT-5.3-Codex/OpenCode) and merged on May 5, 2026, with backports to all supported release branches completed shortly after. No significant broader media coverage or social media discussion has been identified beyond the official advisory (GitHub Advisory, Fix PR).