Decidim Gem Vulnerability: Verification Documents Exposed
An early warning has been issued regarding a vulnerability in the Decidim gem where verification documents can be accessed via reusable links.
What happened
The Decidim gem's verification admin UI is reportedly exposing scanned documents through reusable Active Storage disk links. This allows anyone with the URL to retrieve the document until the signature expires. Affected versions range from 0.14.0 to 0.32.0.rc3, with specific fixes available in certain versions. It is recommended to review and update the Decidim gem to ensure verification documents are not exposed through reusable links. For detailed version information and fixes, consult the primary sources.
How 0Day mitigates this
decidim is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.