Decidim’s private data export feature allows a logged‑in user to initiate a download that ends with a signed Active Storage blob URL. The controller authenticates the export owner, but the redirect URL is not tied to the session, meaning anyone who obtains that URL can re‑use it to download the data. The result is unauthorized disclosure of private content, an instance of information exposure (CWE‑200) and improper authorization (CWE‑284).

The vulnerability affects the Decidim participatory democracy framework. Versions prior to 0.30.9, from 0.31.0 up to before 0.31.5, and from 0.32.0.rc1 up to before 0.32.0.rc2 are impacted. Updating to 0.30.9 or later, 0.31.5 or later, or 0.32.0.rc2 or later removes the flaw.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % reflects a low likelihood of active exploitation. The issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by capturing a valid download link and replaying it, without needing additional privileges or exploiting other vulnerabilities. No complex conditions or chained attacks are required beyond possession of the replayable URL.