--- title: Private exports can be downloaded through reusable links description: A medium-severity CVE (CVE-2026-45377) has been disclosed for the decidim-core Ruby gem. The vulnerability allows private data exports generated via the... canonical: https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Private exports can be downloaded through reusable links | daily.dev og:description: A medium-severity CVE (CVE-2026-45377) has been disclosed for the decidim-core Ruby gem. The vulnerability allows private data exports generated via the... og:url: https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul og:image: https://api.daily.dev/og/posts/aEwCqn8UL.png og:image:alt: Private exports can be downloaded through reusable links og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Private exports can be downloaded through reusable links **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary A medium-severity CVE (CVE-2026-45377) has been disclosed for the decidim-core Ruby gem. The vulnerability allows private data exports generated via the download_your_data flow to be accessed without authentication by anyone who obtains the Active Storage blob redirect URL. These URLs can leak through browser history, logs, referrers, screenshots, copied links, or intercepted emails. Patched versions are 0.30.9, 0.31.5, and 0.32.0. The issue was discovered during a security audit by Radically Open Security. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CVE-2025-65017 \(decidim\): Decidim's private data exports can lead to data leaks](https://daily.dev/posts/cve-2025-65017-decidim-decidim-s-private-data-exports-can-lead-to-data-leaks-39w2g3e6e) · RUBYLAND · 0 upvotes · 0 comments - [Verification documents can be downloaded through reusable links](https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j) · RUBYLAND · 0 upvotes · 0 comments - [Verification admins can access supplied IDs from other organizations](https://daily.dev/posts/verification-admins-can-access-supplied-ids-from-other-organizations-syxarsevh) · RUBYLAND · 0 upvotes · 0 comments - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ruby](https://daily.dev/tags/ruby), [#data-privacy](https://daily.dev/tags/data-privacy) [View this post on daily.dev](https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Private exports can be downloaded through reusable links","url":"https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul"},"datePublished":"2026-07-15T23:21:34.186Z","dateModified":"2026-07-15T23:21:53.582Z","description":"A medium-severity CVE (CVE-2026-45377) has been disclosed for the decidim-core Ruby gem. The vulnerability allows private data exports generated via the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ruby,data-privacy","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"Private exports can be downloaded through reusable links"}]} ```