The verification admin mutation flow in Decidim loads pending authorization records using a raw database query without verifying organizational ownership. This allows a verification admin from one tenant to access and manage identity document verification requests from another tenant. The vulnerability is classified as broken access control (CWE-200). It affects Decidim versions before 0.30.9. The issue was discovered during a security audit and a patch is available in the Decidim repository. The vulnerability has moderate severity with a CVSS 3.1 vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with verification admin privileges in one organization can view sensitive identity documents submitted by participants of other organizations, and can approve or reject those verification requests. This leads to unauthorized disclosure of personally identifiable information and unauthorized modification of verification status across tenant boundaries.

A patch is available as referenced in the Decidim GitHub pull request https://github.com/decidim/decidim/pull/16666. Users should upgrade to version 0.30.9 or later where this issue is fixed. As a temporary workaround, disabling the "Identity documents" verification feature prevents cross-tenant access. No other mitigation steps are indicated by the vendor advisory.