CVE-2026-45377General

LOWCVSS 6.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
General: 2 classified signals
Disclosure: 1 classified signal
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud91d
General
🚨*CVE* CVE-2026-45377 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow re… https://www.cve.org/CVERecord?id=CVE-2026-45377 ----- Traducción: CVE-2026-45377 Dec… http://infoflow.cloud`
Post summary
The post identifies CVE-2026-45377 and lists affected version ranges for Decidim, but provides no further technical, exploit, or mitigation details.
0000036
96 followersView on X
CVE@CVEnew91d
General
CVE-2026-45377 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow re… https://www.cve.org/CVERecord?id=CVE-2026-45377
Post summary
The text identifies CVE-2026-45377 as impacting several Decidim versions but provides no PoC, exploit code, patch info, or evidence of active exploitation.
00000888
57.9K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-45377 Unauthenticated Access to Decidim Export Data via Active Storage Blob URL Replay https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45377
Post summary
The post references CVE-2026-45377, highlighting an unauthenticated access flaw in Decidim through Active Storage Blob URL replay, and links to a vulnerability database for more details.
00000101
4.1K followersView on X

Explore more

Back to dashboard