CVE-2025-65017
📋 TL;DR
This vulnerability in Decidim's private data export feature allows UUID collisions that could lead to unauthorized access to sensitive user data. Organizations using Decidim versions 0.30.0-0.30.3 or 0.31.0.rc1 are affected, potentially exposing private participant information.
💻 Affected Systems
- Decidim
📦 What is this software?
Decidim by Decidim
Decidim by Decidim
Decidim by Decidim
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access all private data exports, exposing sensitive participant information including personal details, voting records, and confidential discussions.
Likely Case
Partial data leakage where some private exports become accessible to unauthorized users due to UUID collisions.
If Mitigated
No data leakage occurs as proper UUID generation ensures unique, non-colliding identifiers for each export.
🎯 Exploit Status
Exploitation requires understanding of UUID generation collisions and access to the Decidim instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.30.4 or 0.31.0
Vendor Advisory: https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
Restart Required: Yes
Instructions:
1. Backup your Decidim database and application. 2. Update Gemfile to require 'decidim' version '~> 0.30.4' or '~> 0.31.0'. 3. Run 'bundle update decidim'. 4. Run database migrations if needed. 5. Restart the application server.
🔧 Temporary Workarounds
Disable Private Data Exports
allTemporarily disable the private data export functionality to prevent data leakage.
# Configure Decidim to disable exports in config/initializers/decidim.rb
config.exports = { enabled: false }
🧯 If You Can't Patch
- Implement strict access controls and monitoring for data export functionality
- Enable detailed logging for all data export activities and review regularly
🔍 How to Verify
Check if Vulnerable:
Check your Gemfile.lock for Decidim version: grep -i decidim Gemfile.lockCheck Version:
grep -A2 -B2 decidim Gemfile.lock | grep -E 'version|decidim'Verify Fix Applied:
Verify the updated version in Gemfile.lock shows 0.30.4 or higher, or 0.31.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to data export endpoints
- Multiple failed UUID generation attempts
- Unexpected successful data export downloads
Network Indicators:
- Unusual traffic to /exports or similar data export endpoints
- Multiple requests for the same export UUID
SIEM Query:
source="decidim_logs" AND (uri_path="/exports" OR message="UUID collision" OR message="export access")