CVE-2023-48220

MEDIUM
Published Feb 20, 2024 Modified Dec 16, 2024 CWE-672

Description

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database.

Is your site exposed to CVE-2023-48220?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.7
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-672 CWE-672

Affected Products

Vendor Product
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
decidim decidim
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable
scambra devise_invitable

References

Other References

https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198 https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

Frequently Asked Questions

What is CVE-2023-48220? +
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database. It has a CVSS v3.1 base score of 5.7 (MEDIUM).
How severe is CVE-2023-48220? +
CVE-2023-48220 has a CVSS v3.1 score of 5.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2023-48220? +
CVE-2023-48220 affects products from decidim, scambra, specifically: decidim, devise_invitable. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2023-48220? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-2517

Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
CVE-2025-22149

JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided …
CVE-2026-33278 9.8

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial …
CVE-2013-10075 9.1

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that …
CVE-2024-47571 8.1

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain …
CVE-2026-43585 8.1

OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2023-48220 — free, no signup required.