CVE-2025-65017 Decidim's private data exports can lead to data leaks

High 8.2 Published 3 Feb 2026 Updated 3 Feb 2026

Attackers can access private data exports due to UUID collisions, exposing sensitive information in Decidim participatory democracy platforms.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-65017?

CVE-2025-65017 is a high-severity vulnerability in decidim, published on 3 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

Weakness: CWE-703, CWE-200

Which versions are affected by CVE-2025-65017?

4 open source packages ship an affected version, including decidim and decidim-core. It affects 1 product.

Package	Affected	Fixed in
`decidim` RubyGems	From `0.30.0`	`0.30.4`
`decidim` RubyGems	From `0.30.0`	`0.30.4`
`decidim-core` RubyGems	From `0.30.0`	`0.30.4`
`decidim-core` RubyGems	From `0.30.0`	`0.30.4`

Products include Decidim Decidim.

How do I fix CVE-2025-65017?

Upgrade decidim to 0.30.4 or later.

Is CVE-2025-65017 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65017 exists.

Sources

Also known as GHSA-3cx6-j9j4-54mp.