Threats tagged 'ghsa-86fh-w43w-338c'

A vulnerability in Decidim verification admin functionality allows an admin from one organization to access, approve, or reject identity document verification requests belonging to participants of other organizations. This occurs because the system does not verify that the pending authorization record belongs to the current organization before allowing access and actions. The issue affects Decidim versions prior to 0.30.9. A patch is available as referenced in the Decidim GitHub pull request. As a workaround, disabling the "Identity documents" verification feature can prevent exploitation.