What is CVE-2023-48220?

CVE-2023-48220 is a medium-severity security vulnerability in decidim (rubygems), affecting versions >= 0.0.1.alpha3, < 0.26.9. It is fixed in 0.26.9, 2.0.9, 0.27.5.

How severe is CVE-2023-48220?

CVE-2023-48220 has a CVSS score of 5.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which packages are affected by CVE-2023-48220?

decidim (rubygems) versions >= 0.0.1.alpha3, = 0.0.1.alpha3, = 0.0.1.alpha3, = 0.4.rc3, < 2.0.9.

Is there a fix for CVE-2023-48220?

Yes. CVE-2023-48220 is fixed in 0.26.9, 2.0.9, 0.27.5. Upgrade to this version or later.

Is CVE-2023-48220 exploitable, and should I be worried?

Whether CVE-2023-48220 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2023-48220 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2023-48220?

Upgrade: decidim to 0.26.9 or later, decidim-admin to 0.26.9 or later, decidim-system to 0.26.9 or later, devise_invitable to 2.0.9 or later, decidim to 0.27.5 or later, decidim-admin to 0.27.5 or later, decidim-system to 0.27.5 or later.

CVE-2023-48220 in decidim

Q: How severe is CVE-2023-48220?

CVE-2023-48220 has a CVSS score of 5.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which packages are affected by CVE-2023-48220?

decidim (rubygems) versions >= 0.0.1.alpha3, = 0.0.1.alpha3, = 0.0.1.alpha3, = 0.4.rc3, < 2.0.9.

Q: Is there a fix for CVE-2023-48220?

Yes. CVE-2023-48220 is fixed in 0.26.9, 2.0.9, 0.27.5. Upgrade to this version or later.

Q: Is CVE-2023-48220 exploitable, and should I be worried?

Whether CVE-2023-48220 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2023-48220 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2023-48220?

Upgrade: decidim to 0.26.9 or later, decidim-admin to 0.26.9 or later, decidim-system to 0.26.9 or later, devise_invitable to 2.0.9 or later, decidim to 0.27.5 or later, decidim-admin to 0.27.5 or later, decidim-system to 0.27.5 or later.

Summary

Possibility to circumvent the invitation token expiry period

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem:
https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim:
https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim:
https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem:
https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation:
https://github.com/scambra/devise_invitable#model-configuration-

invite_for: The period the generated invitation token is valid. After this period, the invited resource won’t be able to accept the invitation. When invite_for is 0 (the default), the invitation won’t expire.

Decidim sets this configuration to 2.weeks so this configuration should be respected:
https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

CVE-2023-48220 has a CVSS score of 5.7 (Medium). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.26.9, 2.0.9, 0.27.5); upgrading removes the vulnerable code path.

Affected versions

decidim (>= 0.0.1.alpha3, < 0.26.9) decidim-admin (>= 0.0.1.alpha3, < 0.26.9) decidim-system (>= 0.0.1.alpha3, < 0.26.9) devise_invitable (>= 0.4.rc3, < 2.0.9) decidim (>= 0.27.0, < 0.27.5) decidim-admin (>= 0.27.0, < 0.27.5) decidim-system (>= 0.27.0, < 0.27.5)

Security releases

decidim → 0.26.9 (rubygems) decidim-admin → 0.26.9 (rubygems) decidim-system → 0.26.9 (rubygems) devise_invitable → 2.0.9 (rubygems) decidim → 0.27.5 (rubygems) decidim-admin → 0.27.5 (rubygems) decidim-system → 0.27.5 (rubygems)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Frequently Asked Questions

What is CVE-2023-48220? CVE-2023-48220 is a medium-severity security vulnerability in decidim (rubygems), affecting versions >= 0.0.1.alpha3, < 0.26.9. It is fixed in 0.26.9, 2.0.9, 0.27.5.
How severe is CVE-2023-48220? CVE-2023-48220 has a CVSS score of 5.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which packages are affected by CVE-2023-48220?
- decidim (rubygems) (versions >= 0.0.1.alpha3, < 0.26.9)
- decidim-admin (rubygems) (versions >= 0.0.1.alpha3, < 0.26.9)
- decidim-system (rubygems) (versions >= 0.0.1.alpha3, < 0.26.9)
- devise_invitable (rubygems) (versions >= 0.4.rc3, < 2.0.9)
Is there a fix for CVE-2023-48220? Yes. CVE-2023-48220 is fixed in 0.26.9, 2.0.9, 0.27.5. Upgrade to this version or later.
Is CVE-2023-48220 exploitable, and should I be worried? Whether CVE-2023-48220 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2023-48220 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2023-48220?
- Upgrade decidim to 0.26.9 or later
- Upgrade decidim-admin to 0.26.9 or later
- Upgrade decidim-system to 0.26.9 or later
- Upgrade devise_invitable to 2.0.9 or later
- Upgrade decidim to 0.27.5 or later
- Upgrade decidim-admin to 0.27.5 or later
- Upgrade decidim-system to 0.27.5 or later

Other vulnerabilities in decidim

CVE-IDSeverityPackage summary

CVE-2026-45414Highdecidim: Decidim: JWT-backed authentication can be replayed across organizations CVE-2025-65017Highdecidim-core: Decidim's private data exports can lead to data leaks CVE-2024-41673Highdecidim: Decidim has a cross-site scripting vulnerability in the version control page CVE-2024-39910Mediumdecidim: Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor CVE-2024-32469Mediumdecidim: Decidim cross-site scripting (XSS) in the pagination