devise_invitable

Version	Released
`3.0.0` major	Oct 28, 2026
`2.0.14` patch	Oct 01, 2026
`2.0.13` patch	Sep 25, 2026
`2.0.12` patch	May 07, 2026
`2.0.11` patch	May 23, 2025
`2.0.10` patch	Mar 25, 2025
`2.0.9` patch	Oct 30, 2023
`2.0.8` patch 1 CVE	Apr 27, 2023
`2.0.7` patch 1 CVE	Jan 09, 2023
`2.0.6` patch 1 CVE	Dec 15, 2021
`2.0.5` patch 1 CVE	Apr 19, 2021
`2.0.4` patch 1 CVE	Apr 13, 2021
`2.0.3` patch 1 CVE	Nov 20, 2020
`2.0.2` patch 1 CVE	May 06, 2020
`2.0.1` patch 1 CVE	Apr 05, 2019
`2.0.0` major 1 CVE	Feb 25, 2019
`1.7.5` patch 1 CVE	Oct 17, 2018
`1.7.4` patch 1 CVE	Apr 09, 2018
`1.7.3` patch 1 CVE	Feb 09, 2018
`1.7.2` patch 1 CVE	Mar 28, 2017
`1.7.1` patch 1 CVE	Feb 17, 2017
`1.7.0` minor 1 CVE	Aug 04, 2016
`1.6.1` patch 1 CVE	Aug 04, 2016
`1.6.0` minor 1 CVE	Apr 20, 2016
`1.5.5` patch 1 CVE	Dec 17, 2015
`1.5.3` patch 1 CVE	Sep 30, 2015
`1.5.2` patch 1 CVE	Jul 23, 2015
`1.5.1` patch 1 CVE	Jun 16, 2015
`1.5.0` minor 1 CVE	Jun 03, 2015
`1.4.2` patch 1 CVE	Mar 27, 2015
`1.4.1` patch 1 CVE	Feb 17, 2015
`1.4.0` minor 1 CVE	Oct 21, 2014
`1.3.6` patch 1 CVE	Jul 21, 2014
`1.3.5` patch 1 CVE	May 09, 2014
`1.3.4` patch 1 CVE	Feb 27, 2014
`1.3.3` patch 1 CVE	Jan 30, 2014
`1.3.2` patch 1 CVE	Jan 04, 2014
`1.3.1` patch 1 CVE	Nov 05, 2013
`1.3.0` minor 1 CVE	Oct 03, 2013
`1.2.1` minor 1 CVE	Aug 22, 2013
`1.1.8` patch 1 CVE	May 02, 2013
`1.1.7` patch 1 CVE	Apr 01, 2013
`1.1.6` patch 1 CVE	Feb 21, 2013
`1.1.5` patch 1 CVE	Jan 24, 2013
`1.1.4` patch 1 CVE	Dec 05, 2012
`1.1.3` patch 1 CVE	Nov 19, 2012
`1.1.2` patch 1 CVE	Nov 12, 2012
`1.1.1` patch 1 CVE	Oct 17, 2012
`1.1.0` minor 1 CVE	Aug 20, 2012
`1.0.3` patch 1 CVE	Jul 20, 2012

3.0.0 major

Oct 28, 2026

2.0.14 patch

Oct 01, 2026

2.0.13 patch

Sep 25, 2026

2.0.12 patch

May 07, 2026

2.0.11 patch

May 23, 2025

2.0.10 patch

Mar 25, 2025

2.0.9 patch

Oct 30, 2023

2.0.8 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 27, 2023

2.0.7 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 09, 2023

2.0.6 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 15, 2021

2.0.5 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 19, 2021

2.0.4 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 13, 2021

2.0.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 20, 2020

2.0.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

May 06, 2020

2.0.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 05, 2019

2.0.0 major

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 25, 2019

1.7.5 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 17, 2018

1.7.4 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 09, 2018

1.7.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 09, 2018

1.7.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 28, 2017

1.7.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 17, 2017

1.7.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2016

1.6.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2016

1.6.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 20, 2016

1.5.5 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 17, 2015

1.5.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 30, 2015

1.5.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 23, 2015

1.5.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 16, 2015

1.5.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 03, 2015

1.4.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 27, 2015

1.4.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 17, 2015

1.4.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 21, 2014

1.3.6 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 21, 2014

1.3.5 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

May 09, 2014

1.3.4 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 27, 2014

1.3.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 30, 2014

1.3.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 04, 2014

1.3.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 05, 2013

1.3.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 03, 2013

1.2.1 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 22, 2013

1.1.8 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

May 02, 2013

1.1.7 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 01, 2013

1.1.6 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 21, 2013

1.1.5 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 24, 2013

1.1.4 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 05, 2012

1.1.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 19, 2012

1.1.2 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 12, 2012

1.1.1 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 17, 2012

1.1.0 minor

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 20, 2012

1.0.3 patch

1 CVE

CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10

Medium

Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions


          0.4.0


          0.4.1


          0.4.2


          0.4.rc3


          0.4.rc4


          0.4.rc5


          0.5.0


          0.5.1


          0.5.2


          0.5.3


          0.5.4


          0.5.5

+ 50 more


            0.5.6


            0.5.7


            0.6.0


            0.6.1


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.1.4


            1.1.5


            1.1.6


            1.1.7


            1.1.8


            1.2.1


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.3.4


            1.3.5


            1.3.6


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.5


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8

Fixed in


          2.0.9

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 20, 2012

Activity

Reach

Details