CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links
Attackers can access private user data exports by replaying signed Active Storage URLs without authentication, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45377?
CVE-2026-45377 is a medium-severity vulnerability in decidim, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Which versions are affected by CVE-2026-45377?
6 open source packages ship an affected version, including decidim-core.
| Package | Affected | Fixed in |
|---|---|---|
decidim-core RubyGems | All versions | 0.30.9 |
decidim-core RubyGems | All versions | 0.30.9 |
decidim-core RubyGems | From 0.31.0.rc1 | 0.31.5 |
decidim-core RubyGems | From 0.31.0.rc1 | 0.31.5 |
decidim-core RubyGems | From 0.32.0.rc1 | 0.32.0 |
decidim-core RubyGems | From 0.32.0.rc1 | 0.32.0 |
How do I fix CVE-2026-45377?
Upgrade decidim-core to a fixed version for your release line: 0.30.9, 0.31.5 or 0.32.0.
Is CVE-2026-45377 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45377 exists.
Sources
Also known as GHSA-767h-63j4-5226.