Fides versions >= 2.75.0 and < 2.83.2 contain an authentication bypass vulnerability (CWE-288) that allows an administrator to approve privacy requests without verifying the subject's identity when both identity verification and duplicate request detection are enabled. This can result in unauthorized deletion of data subject records across all integrations in the deployment. The issue is resolved in version 2.83.2. The vulnerability has a CVSS 4.0 score of 6.1 (medium severity) and no known active exploits. The vendor has released a fixed version, but no explicit patch advisory content is provided in the input.

An attacker with administrator privileges can bypass identity verification controls to approve privacy requests improperly. For erasure policies, this can lead to unauthorized deletion of personal data across all connected integrations, potentially causing data loss and compliance issues. The impact is limited to deployments that enable both subject identity verification and duplicate privacy request detection.

Upgrade affected Fides deployments to version 2.83.2 or later, where this vulnerability is fixed. Since the vendor advisory content is not provided, patch status is inferred from the version information. Patch status is not yet explicitly confirmed in the input data; therefore, verify the vendor advisory for the latest remediation guidance. Until patched, consider disabling either subject identity verification or duplicate privacy request detection features to mitigate risk, if feasible.