Threats tagged 'ghsa-r3v7-5x4c-c69q'

Decidim versions prior to 0.31.5 have a vulnerability where JSON Web Tokens (JWTs) issued for one organization can be replayed against another organization's API. This allows unauthorized access to sensitive participant details and mutation paths intended for that other organization. The issue arises because JWT authentication is not sufficiently bound to the host organization context, enabling cross-organization token reuse.