« Back to list

CVE-2026-45414

Status: DeferredHigh (8.5)—

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N/PR:L requiere acceso remoto autenticado (T1210). JWT reutilizado entre tenants permite escalada horizontal y lectura de participantDetails (T1078, T1005). La pista confirma T1210 + T1078.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Decidim — DecidimAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-45414",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45414",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-07T17:50:28.456696Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "decidim",
          "product": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.31.5"
            },
            {
              "status": "affected",
              "version": ">= 0.32.0.rc1, < 0.32.0.rc2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-06T22:17:06.873",
  "references": [
    {
      "url": "https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/decidim/decidim/commit/226dc94894e6a3c030e4638c8b3441ee7199643c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/decidim/decidim/releases/tag/v0.31.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2."
    }
  ],
  "lastModified": "2026-09-08T20:51:43.490",
  "sourceIdentifier": "security-advisories@github.com"
}