The vulnerability in Decidim allows an identity‑document verification administrator from one tenant to load pending Authorization records by raw identifier without confirming organization ownership. Because the check for current_organization is omitted, the admin can view, approve, or reject identity‑document requests belonging to another tenant. This exposes confidential verification data and enables an attacker to tamper with another organization’s records, violating confidentiality, integrity, and potentially availability.

Decidim open source participatory democracy framework is affected. Versions before 0.30.9, from 0.31.0 to before 0.31.5, and from 0.32.0.rc1 to before 0.32.0.rc2 contain the flaw. The issue is fixed in releases 0.30.9, 0.31.5, and 0.32.0.rc2.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is reported as < 1 %, suggesting a very low, but non‑zero, likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. A likely attack path would involve an attacker first obtaining administrative access within one tenant; from that position the attacker can exploit the missing ownership check to access data from other tenants. Since the flaw requires tenant‑level admin privileges, the scope is limited to environments that host multiple organizations on a single instance.