CyberRota Analysis
AI-GeneratedThe vulnerability affects the Decidim participatory democracy framework, specifically in the identity-document verification admin controllers, which improperly handle pending Authorization records by not verifying ownership against the current organization. This oversight allows an administrator from one tenant to access and manipulate ID-document requests belonging to another tenant, potentially compromising sensitive identity verification processes. Organizations using affected versions prior to the specified patches should prioritize updating to mitigate the risk of unauthorized access and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.