CVE-2026-45414 in Decidim
Summary
by MITRE • 08/07/2026
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Decidim framework represents a critical authorization bypass that stems from improper JWT token binding to organizational contexts within multi-tenant deployments. This flaw exists in versions prior to 0.31.5 and specifically affects the 0.32.0.rc1 release before 0.32.0.rc2, creating a scenario where authentication tokens issued for one organization can be maliciously reused against another organization's API endpoints. The technical root cause lies in the absence of proper tenant isolation mechanisms within the JWT validation process, allowing tokens to be replayed across different organizational boundaries.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables attackers to escalate privileges and access sensitive participant data through the participantDetails endpoint. This exposure creates a pathway for adversaries to exploit the proposal.answer mutation path, potentially allowing them to manipulate or retrieve confidential information from other organizations within the same Decidim instance. The vulnerability fundamentally undermines the security model of multi-tenant deployments by breaking the isolation guarantees that should exist between different organizational contexts.
This issue maps directly to CWE-287 which addresses improper authentication scenarios in software systems, and aligns with ATT&CK technique T1566 related to credential harvesting through various attack vectors. The vulnerability demonstrates a classic case of insufficient session management where tokens lack proper binding to their originating organizational context, creating a transitive access control problem. Security researchers would categorize this as a privilege escalation vulnerability that leverages the inherent trust model within JWT implementations to bypass expected security boundaries.
The fix implemented in versions 0.31.5 and 0.32.0.rc2 addresses the core issue by enforcing strict organizational context binding during JWT validation. This mitigation ensures that tokens issued for a specific organization cannot be used against API endpoints belonging to different organizations, effectively restoring proper multi-tenant isolation. Organizations should prioritize immediate deployment of these patched versions while implementing additional monitoring to detect potential exploitation attempts. The remediation approach typically involves enhancing the JWT validation middleware to verify organizational identifiers contained within token claims against the target host context, thereby preventing cross-tenant token replay attacks that could otherwise compromise participant privacy and system integrity.