Threats tagged 'ghsa-767h-63j4-5226'

Decidim versions prior to 0.30.9 have a vulnerability where private data exports, intended to be accessible only to the export owner, can be downloaded by anyone who obtains the reusable Active Storage blob URL. This URL is exposed via a redirect after an authenticated request and can be replayed without authentication, potentially leaking personal data through various client-side channels.