CVE-2023-48220

MEDIUM
Published Feb 20, 2024 Modified Dec 16, 2024 CWE-672

Description

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database.

Is your site exposed to CVE-2023-48220?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.7
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-672 CWE-672

Affected Products

Vendor Product
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable

References

Other References

https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198 https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

Frequently Asked Questions

What is CVE-2023-48220? +
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database. It has a CVSS v3.1 base score of 5.7 (MEDIUM).
How severe is CVE-2023-48220? +
CVE-2023-48220 has a CVSS v3.1 score of 5.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2023-48220? +
CVE-2023-48220 affects products from decidim, scambra, specifically: decidim, devise_invitable. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2023-48220? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-2517

Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
CVE-2026-106345

Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the …
CVE-2026-96589

When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as …
CVE-2026-106310

Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the …
CVE-2026-106320

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the …
CVE-2026-106339

Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2023-48220 — free, no signup required.