CVE-2025-65017

EUVD-2025-206733
Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
decidimdecidim
0.30.0 ≤
𝑥
< 0.30.4
decidimdecidim
0.31.0:rc1
decidimdecidim
0.31.0:rc2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/decidim/decidim/pull/13571
https://github.com/decidim/decidim/releases/tag/v0.30.4
https://github.com/decidim/decidim/releases/tag/v0.31.0
https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp