CVE-2026-45377: Decidim: Private exports can be downloaded through reusable links

July 13, 2026

The normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it.

References

github.com/advisories/GHSA-767h-63j4-5226
github.com/decidim/decidim/pull/16680
github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226
nvd.nist.gov/vuln/detail/CVE-2026-45377

Code Behaviors & Features

Detect and mitigate CVE-2026-45377 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →