CVE-2026-45377: 
Ruby vulnerability analysis and mitigation

CVE-2026-45377 is a broken access control vulnerability in Decidim, an open-source participatory democracy platform, where private user data exports can be downloaded without authentication via reusable Active Storage blob redirect URLs. The vulnerability affects decidim-core (RubyGems) versions prior to 0.30.9, 0.31.0.rc1 through 0.31.5, and 0.32.0.rc1 through 0.32.0. It was discovered through a security audit organized by the Decidim Association and conducted by Radically Open Security, with the advisory published on July 13, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Decidim Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), corresponding to OWASP A01:2021 Broken Access Control. Decidim::DownloadYourDataController#download_file correctly scopes the export record to current_user, so the wrapper route itself is protected; however, when the authenticated owner performs a GET request, the response issues an HTTP redirect to a signed Active Storage blob URL (e.g., /rails/active_storage/blobs/redirect/<key>/<filename>) that is not bound to the user session. This signed URL functions as a bearer token — anyone who obtains it can replay the request and download the file without any authentication. The GET-based redirect chain makes the URL particularly susceptible to leakage via browser history, proxy logs, referrer headers, screenshots, copied links, or support transcripts (GitHub Advisory, Decidim Advisory).

Successful exploitation allows any party who obtains the Active Storage blob URL to download a user's personal data export without being authenticated as the export owner. The exported data may contain sensitive personal information subject to privacy regulations, creating significant confidentiality risk. There is no impact on integrity or availability, but the potential for unauthorized access to personal data exports through passive leakage channels (logs, browser history, intercepted emails) makes this a meaningful privacy concern for Decidim deployments (GitHub Advisory).

1. Reconnaissance: Identify a Decidim instance running a vulnerable version of decidim-core (< 0.30.9, 0.31.0.rc1–0.31.5, or 0.32.0.rc1–0.32.0).
2. Obtain the wrapper URL: Through social engineering, phishing, or access to shared resources (e.g., support transcripts, screenshots, browser history), obtain the authenticated wrapper URL used by the export owner, e.g., http://target/download_your_data/download?uuid=<uuid>.
3. Capture the Active Storage redirect URL: Alternatively, if the attacker can intercept network traffic (e.g., via a shared proxy, MITM, or browser extension), monitor the redirect chain when the legitimate owner accesses the wrapper URL. The response will redirect to a URL matching /rails/active_storage/blobs/redirect/<key>/<filename>.
4. Replay the blob URL without authentication: In a browser with no active Decidim session (e.g., private/incognito window), paste the captured Active Storage blob URL directly.
5. Download the export file: The file downloads successfully without any authentication check, exposing the user's personal data export (GitHub Advisory, Decidim Advisory).

• Network: Unauthenticated GET requests to /rails/active_storage/blobs/redirect/ paths originating from IP addresses or user agents not associated with the legitimate export owner; repeated access to the same blob URL from different sessions or IP addresses.
• Logs: Web server or application logs showing successful (HTTP 200) responses to Active Storage blob redirect URLs from sessions with no associated Decidim authentication cookie; access log entries for /rails/active_storage/blobs/redirect/ from unexpected geographic locations or at unusual times relative to the original authenticated download.
• Application Logs: Absence of a corresponding authenticated session for requests to Active Storage blob URLs that were previously accessed by a legitimate user session.

Decidim has released patched versions 0.30.9, 0.31.5, and 0.32.0 that introduce a new PrivateDownloads controller which streams protected files via Rails' send_data method rather than redirecting to Active Storage URLs, ensuring access control is enforced at every download request. Upgrading to one of these patched versions is the recommended remediation. As a temporary workaround for deployments that cannot immediately upgrade, the advisory recommends disabling Private Download URLs. The fix was implemented in pull request #16680 (GitHub Advisory, Decidim Advisory).

The vulnerability was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, funded by NGI, indicating a proactive security posture by the project maintainers. The fix was developed and merged prior to public disclosure, and the advisory credits the auditing organization. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Decidim Advisory).