Decidim before version 0.31.5 and the 0.32.0.rc1 release allows API authentication with JSON Web Tokens that are not bound to the organization that issued them. Consequently, a token generated for one tenant can be replayed against another tenant’s API endpoint, granting the bearer the ability to read participant details and execute the proposal.answer mutation. This flaw results in unauthorized read and write operations that compromise confidentiality, integrity, and availability at the organization level, and is classified as an authentication bypass (CWE‑639) and improper authorization (CWE‑863).

All instances of the Decidim framework running any version prior to 0.31.5 or before 0.32.0.rc2 are affected. Organizations using those versions of the open‑source Decidim platform must upgrade to at least version 0.31.5 or the 0.32.0.rc2 release to eliminate the vulnerability.

The CVSS score of 8.5 indicates high severity, while the EPSS score is not available, making precise exploitation probability unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an attacker only needs a valid JWT issued for one tenant and can target another tenant’s publicly reachable API. No privileged access or physical proximity is required because the flaw relies solely on token reuse across tenants.