Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:17:06.690Z",
  "pubdate": "2026-08-06T22:17:06.690Z",
  "executiveSummary": "A broken access control vulnerability exists in the Decidim participatory democracy framework, specifically within the identity-document verification administrative user interface. The vulnerability arises because verification-document images are rendered using Rails variant_url(...) methods, generating direct, reusable signed Active Storage disk URLs rather than routing file access through an authorization-checking controller.\nThis design flaw allows any malicious actor who intercepts or obtains a signed URL to download sensitive scanned identity documents without maintaining an authenticated Decidim session. Because Decidim configures Active Storage service URLs with a prolonged validity period of seven days, the resulting signed URL effectively functions as a static credential throughout that timeframe.\nThe affected components comprise verification_attachment blobs on Decidim::Authorization instances, which are directly embedded into the HTML of admin review pages for both pending and confirmation views. Consequently, administrators or network observers exposing these URLs inadvertently grant unauthorized third-party access to confidential PII.\nThe risk implications involve severe privacy breaches and unauthorized exposure of identity verification documents. Exploitation requires an attacker to capture or deduce a valid signed Active Storage disk URL, after which no authentication or privilege level is required to retrieve the underlying file via network requests until the cryptographic signature expires.",
  "technicalDetails": "The vulnerability stems from improper handling of authorization controls for file attachments within Ruby on Rails Active Storage implementations in Decidim. The root cause is the utilization of variant_url(...) to generate direct disk service links for verification_attachment blobs on Decidim::Authorization records.\nInstead of routing file retrieval requests through a secured application controller that validates current session authentication, administrator roles, and authorization privileges, the admin review pages render signed /rails/active_storage/disk/... links directly into the HTML markup of pending and confirmation views.\nActive Storage disk URLs are cryptographically signed to prevent tampering, but they are not inherently tied to user session tokens or ephemeral request contexts. Decidim explicitly configures these service URLs to remain valid for seven consecutive days. Therefore, the signature acts as a bearer token valid across network boundaries for the entire duration.\nThe attack flow proceeds as follows: First, an administrative user navigates to the identity-document verification admin UI, which loads the affected HTML pages embedding the signed Active Storage URLs. Second, an adversary captures these URLs through network traffic inspection, referrer headers, browser history exposure, or compromised administrative endpoints. Third, the attacker issues direct HTTP GET requests to the /rails/active_storage/disk/... endpoints from an unauthenticated context, bypassing all Decidim session checks.\nBecause the underlying storage driver serves the file directly based on the validity of the URL signature, the server responds with the binary data of the scanned identity document. No special payload behavior, memory corruption, or complex privilege escalation is required to achieve this post-exploitation impact.\nThe affected product is Decidim. The vulnerable versions include all versions prior to 0.30.9, versions from 0.31.0 before 0.31.5, and version 0.32.0.rc1 prior to 0.32.0.rc2. Network exposure is external via standard HTTP/HTTPS protocols servicing the Rails application routes."
}