CVE-2026-45414
Decidim: JWT-backed authentication can be replayed across organizations
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
| CWE | CWE-639 CWE-863 |
| Vendor | decidim |
| Product | decidim |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for decidim decidim
Be the first to know when new high vulnerabilities affecting decidim decidim are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
decidim / decidim
< 0.31.5 >= 0.32.0.rc1, < 0.32.0.rc2
References
github.com: https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q github.com: https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1 github.com: https://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c github.com: https://github.com/decidim/decidim/releases/tag/v0.31.5 github.com: https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2