Description

Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/active_storage/disk/ URLs that can be fetched without any authenticated session.

Anyone who obtains one of those URLs can retrieve the document until the signature expires.

Impact

• This only applies to Organizations using the \"Identity documents\" verification
• Any party that obtains one of these URLs can download the underlying scanned identity document for the lifetime of the signed link without needing to authenticate as the reviewing admin.
• In the reproduced case, that replay window was about seven days, which is long enough for routine leakage channels such as copied links, screenshots, logs, browser history, and support workflows to become realistic exfiltration paths.
• This raises the risk of leakage through browser history, screenshots, copy-paste, support tickets, logs, analytics tooling, malicious browser extensions, or any other channel that captures full URLs.
• Because the affected files are identity-verification documents, the exposed data can include highly sensitive personal information.

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.