CVE-2026-45378: 
Ruby vulnerability analysis and mitigation

CVE-2026-45378 is a sensitive information exposure vulnerability in Decidim, an open-source participatory democracy framework, where scanned identity-document images are exposed through reusable signed Active Storage disk URLs that do not require an authenticated session to access. The vulnerability affects the decidim-verifications RubyGems package in versions prior to 0.30.9, from 0.31.0.rc1 before 0.31.5, and from 0.32.0.rc1 before 0.32.0.rc2. It was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, with the advisory published on July 13, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Decidim Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The verification admin UI renders identity-document images using variant_url(...), which generates signed /rails/active_storage/disk/... URLs rather than routing file access through an authorization-checking controller. Because Decidim configures Active Storage service URLs with a seven-day validity window, the signed URL itself acts as the credential — anyone who obtains the URL can download the underlying document without any Decidim session for up to seven days. The signed URLs are embedded directly into the HTML of admin review pages (pending and confirmation views), making them accessible via browser history, logs, screenshots, analytics tooling, or malicious browser extensions (GitHub Advisory, Decidim Advisory).

Exploitation allows any party who obtains a signed Active Storage URL — through browser history, copy-paste, support tickets, logs, or network interception — to download scanned identity-verification documents (e.g., government-issued IDs) without authenticating to Decidim. The exposure window is up to seven days per URL, and the affected data constitutes highly sensitive personal information subject to privacy regulations. The impact is limited to confidentiality (no integrity or availability impact), and only affects organizations using the "Identity documents" verification feature (Decidim Advisory).

The vulnerability has a low attack complexity and requires no privileges or user interaction, making it automatable and straightforward to exploit once a signed URL is obtained. The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept available), with reproduction steps publicly documented in the advisory. The EPSS score is approximately 0.303% (23rd percentile), indicating a relatively low but non-negligible probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog inclusion (GitHub Advisory, Decidim Advisory).

1. Identify a target instance: Locate a Decidim instance running an affected version (< 0.30.9, 0.31.0.rc1–0.31.4, or 0.32.0.rc1) that has the "Identity documents" verification feature enabled.
2. Submit a verification request: As a normal user, navigate to /id_documents/authorizations/new and submit an identity document verification request with an image attachment.
3. Access the admin review page: Log in as an administrator and navigate to /admin/id_documents to view pending verification requests.
4. Harvest the signed Active Storage URL: Open browser DevTools (Network tab), reload the admin review page, and copy a request URL matching the pattern /rails/active_storage/disk/<token>.
5. Replay the URL without authentication: Open a private/incognito browser window where no Decidim session exists, paste the copied URL, and confirm the identity document image loads successfully without any authentication.
6. Exfiltrate or share the URL: The signed URL remains valid for approximately seven days, allowing the attacker to share, store, or use it to download the sensitive identity document at any time within that window (Decidim Advisory, GitHub Advisory).

• Network: Unauthenticated HTTP GET requests to /rails/active_storage/disk/<token> paths originating from IP addresses or user agents not associated with active admin sessions; repeated access to the same signed URL from different IP addresses or browsers.
• Logs: Web server or application logs showing successful (HTTP 200) responses to /rails/active_storage/disk/ URLs from sessions lacking a valid Decidim authentication cookie; access log entries for these URLs outside of normal admin working hours.
• File System: No direct file system indicators, as exploitation occurs via URL replay without server-side file modification.
• Application: Admin audit logs (if enabled) showing identity document review page loads followed by access to the same blob URL from a different session or IP address (Decidim Advisory).

Decidim has released patched versions 0.30.9, 0.31.5, and 0.32.0.rc2 (and 0.32.0 final) that address this vulnerability by routing file access through an authorization-checking controller instead of exposing raw signed disk URLs. Organizations unable to upgrade immediately should disable the "Identity documents" verification feature as a temporary workaround. Upgrading to a patched version is the recommended long-term remediation (GitHub Advisory, Decidim Advisory).

The vulnerability was discovered through a formal security audit organized by the Decidim Association and conducted by Radically Open Security, funded by NGI, indicating a proactive security posture by the project. The advisory credits coordinator andreslucena and references OWASP A01:2021 (Broken Access Control) as the relevant security standard. No significant broader media coverage or notable community controversy has been identified beyond the official advisory (Decidim Advisory).