--- title: Verification documents can be downloaded through... description: A high-severity CVE (CVSS 7.5) has been disclosed in the decidim-verifications Ruby gem. Scanned identity documents uploaded during the verification workflow... canonical: https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Verification documents can be downloaded through reusable links | daily.dev og:description: A high-severity CVE (CVSS 7.5) has been disclosed in the decidim-verifications Ruby gem. Scanned identity documents uploaded during the verification workflow... og:url: https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j og:image: https://api.daily.dev/og/posts/s7DUGjY6j.png og:image:alt: Verification documents can be downloaded through reusable links og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Verification documents can be downloaded through reusable links **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 0 upvotes · 0 comments ## Summary A high-severity CVE (CVSS 7.5) has been disclosed in the decidim-verifications Ruby gem. Scanned identity documents uploaded during the verification workflow are served via signed Rails Active Storage disk URLs that require no authenticated session to access. Anyone with the URL can download the document for the duration of the signature window, which in testing was approximately seven days. This creates realistic exfiltration paths through browser history, logs, copy-paste, and other URL-capture channels. The vulnerability affects only organizations using the 'Identity documents' verification feature. Patched versions are 0.30.9, 0.31.5, and 0.32.0. The issue was discovered by Radically Open Security in an audit funded by NGI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Verification admins can access supplied IDs from other organizations](https://daily.dev/posts/verification-admins-can-access-supplied-ids-from-other-organizations-syxarsevh) · RUBYLAND · 0 upvotes · 0 comments - [Private exports can be downloaded through reusable links](https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul) · RUBYLAND · 0 upvotes · 0 comments - [CSV census record endpoints improper authorization](https://daily.dev/posts/csv-census-record-endpoints-improper-authorization-rvwoz14g2) · RUBYLAND · 0 upvotes · 0 comments - [I Changed One Number… and Got Access to Citizens’ ID and Address Proofs](https://daily.dev/posts/i-changed-one-number-and-got-access-to-citizens-id-and-address-proofs-qyneutnqa) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rails](https://daily.dev/tags/rails), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Verification documents can be downloaded through reusable links","url":"https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j"},"datePublished":"2026-07-15T23:21:34.533Z","dateModified":"2026-07-15T23:21:55.268Z","description":"A high-severity CVE (CVSS 7.5) has been disclosed in the decidim-verifications Ruby gem. Scanned identity documents uploaded during the verification workflow...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/verification-documents-can-be-downloaded-through-reusable-links-s7dugjy6j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rails,authorization","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"Verification documents can be downloaded through reusable links"}]} ```