CVE-2026-45330: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controller

mediumCVSS 4.9CVE-2026-45330

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.9
Published: 2026-07-31
Last updated: 2026-07-31
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-45330

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-453300.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-45330	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumGHSA-86fh-w43w-338c: Decidim: Veriﬁcation admins can access supplied IDs from other organizationsghsa

Recent advisories for Decidim is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-45377: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, an…nvd · 2026-07-31
mediumCVE-2026-45376: Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, an…nvd · 2026-07-31
mediumCVE-2026-45086: Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 be…nvd · 2026-07-31
mediumGHSA-2g9c-vf8h-prxx: Decidim: Push subscriptions can be abused for server-side requestsghsa · 2026-07-13
mediumGHSA-533c-2vh9-4r86: Decidim: HTML content blocks allow stored script executionghsa · 2026-07-13
mediumGHSA-q79h-67vx-m9xg: Decidim: CSV census record endpoints improper authorizationghsa · 2026-07-13