CVE-2025-65017

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65017
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65017.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-65017
Aliases
Published
2026-02-03T15:05:24.738Z
Modified
2026-04-10T05:34:00.019008Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Decidim's private data exports can lead to data leaks
Details

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-703"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65017.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
14e8bd5deb100766d8afaad0ba98f12fc5802e61
Fixed
d47201a6e34314e9b4deaa6f054b1c8f97874d6b
Database specific 
{
    "versions": [
        {
            "introduced": "0.30.0"
        },
        {
            "fixed": "0.30.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0795da14454a4fb342d70654bdc267d1d6d5bca5
Database specific 
{
    "versions": [
        {
            "introduced": "0.31.0.r1"
        },
        {
            "fixed": "0.31.0"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.1.alpha
v0.0.1.alpha1
v0.0.1.alpha2
v0.0.1.alpha3
v0.0.1.alpha4
v0.0.1.alpha5
v0.0.1.alpha6
v0.0.1.alpha7
v0.0.1.alpha8
v0.0.1.alpha9
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.8.1
v0.1.0
v0.2.0
v0.20.0
v0.3.0
v0.30.0
v0.30.1
v0.30.2
v0.30.3
v0.31.0.rc1
v0.31.0.rc2
v0.4.0
v0.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65017.json"