Threats tagged 'ghsa-3mvf-82qp-8qh5'

Decidim's verification admin workflow exposes scanned identity-document images through signed URLs that do not require authentication. These URLs remain valid for seven days, allowing anyone with the link to download sensitive verification documents without authorization. This vulnerability affects organizations using the "Identity documents" verification feature and risks leakage of highly sensitive personal information through various channels such as browser history, logs, or support workflows.