Decidim Gem Vulnerability: Private Exports Accessible via Reusable Links
An early warning has been issued regarding a vulnerability in the Decidim gem that allows authenticated users to generate reusable links for downloading private exports, potentially leading to unauthorized access.
What happened
The Decidim gem's private export flow reportedly allows authenticated users to generate reusable links for downloading private exports without requiring further authentication. This can lead to unauthorized access to private data. The vulnerability affects various versions of the gem, as detailed in the provided data. It is recommended to upgrade to the latest version of the Decidim gem and review any private exports that may have been exposed. For specific version details and fixed versions, consult the primary sources.
How 0Day mitigates this
decidim is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.