CVE-2026-45378: Decidim: Verification documents can be downloaded through reusable links

July 13, 2026

Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/active_storage/disk/ URLs that can be fetched without any authenticated session.

Anyone who obtains one of those URLs can retrieve the document until the signature expires.

References

github.com/advisories/GHSA-3mvf-82qp-8qh5
github.com/decidim/decidim/pull/16680
github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5
nvd.nist.gov/vuln/detail/CVE-2026-45378

Code Behaviors & Features

Detect and mitigate CVE-2026-45378 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →