Skip to content
Threat Feed
Subscribe

Product

Decidim (< 0.31.5)

1 brief RSS
medium advisory

Decidim JWT Replay Vulnerability Allows Cross-Organization Data Access

A vulnerability, CVE-2026-45414, in Decidim allows an attacker to replay a JSON Web Token (JWT) issued for one organization against another organization's API, permitting an authenticated user from Org 1 to access and retrieve sensitive data, such as GraphQL `participantDetails` and `proposal.answer` mutation paths, from Org 2, effectively bypassing cross-organizational access controls.

Decidim +1 jwt-misconfiguration access-control web-application vulnerability
2t