CyberRota Analysis
AI-GeneratedDecidim's JWT-backed API authentication is vulnerable, allowing attackers to exploit this flaw by replaying tokens issued for one tenant against another tenant's API. This can lead to unauthorized access to sensitive participant details and manipulation of proposal answers. Organizations using affected versions prior to 0.31.5 or 0.32.0.rc2 should prioritize updating to mitigate the risk of data exposure and unauthorized actions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.