VULNERABILITY INTELLIGENCE

CVE-2026-45414

CVSS score8.5 HIGH
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-08-06
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Description

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key
  • CWE-863: Incorrect Authorization

Primary references