The vulnerability arises because Decidim uses Active Storage's signed disk URLs to serve scanned identity-document images in the verification admin UI. These URLs are embedded directly in the admin review pages and remain valid for seven days, effectively making the URL itself a bearer token. Since the URLs can be accessed without an authenticated session, anyone who obtains a URL can retrieve the associated document until the signature expires. This issue affects the verification_attachment blobs on Decidim::Authorization and is classified as broken access control (CWE-200).

Any party that obtains a signed Active Storage URL can access and download scanned identity verification documents without authentication for up to seven days. This exposure risks leakage of highly sensitive personal information through common channels such as copied URLs, browser history, screenshots, logs, or support tickets. The vulnerability specifically impacts organizations using the "Identity documents" verification feature in Decidim, potentially leading to privacy violations and unauthorized data disclosure.

A patch is available in Decidim version 0.30.9 and later that addresses this issue by changing how verification documents are served. Until upgrading, organizations can mitigate risk by disabling the "Identity documents" verification feature. Since this is not a cloud service, remediation requires applying the official fix or disabling the affected feature. Patch status is confirmed by the referenced pull request (https://github.com/decidim/decidim/pull/16680).