CVE-2026-45414: Decidim: JWT-backed authentication can be replayed across organizations

July 13, 2026

A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that JWT to the Org 2 API to read Org 2 participant personal data and reach Org 2’s proposal.answer mutation path.

References

github.com/advisories/GHSA-r3v7-5x4c-c69q
github.com/decidim/decidim/pull/16673
github.com/decidim/decidim/pull/16756
github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
nvd.nist.gov/vuln/detail/CVE-2026-45414

Code Behaviors & Features

Detect and mitigate CVE-2026-45414 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →