CVE-2026-42303

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37
https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd
https://github.com/ethyca/fides/pull/7971
https://github.com/ethyca/fides/pull/7972
https://github.com/ethyca/fides/releases/tag/2.83.2
https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c
https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Fides es una plataforma de ingeniería de privacidad de código abierto. Desde la versión 2.75.0 hasta antes de la 2.83.2, las implementaciones de Fides que habilitan tanto la verificación de identidad del interesado como la detección de solicitudes de privacidad duplicadas se ven afectadas por una vulnerabilidad en la que un administrador puede aprobar una solicitud de privacidad cuya identidad nunca fue verificada. Para las políticas de borrado, esto puede resultar en la eliminación no autorizada de los registros de un interesado en todas las integraciones configuradas en la implementación afectada. Esta vulnerabilidad se corrige en la versión 2.83.2.

Information

Published : 2026-05-12 18:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42303

Mitre link : CVE-2026-42303

CVE.ORG link : CVE-2026-42303

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-306

Missing Authentication for Critical Function

CWE-841

Improper Enforcement of Behavioral Workflow

{"id": "CVE-2026-42303", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42303", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T18:39:40.374950Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": ">= 2.75.0, < 2.83.2"}]}]}], "published": "2026-05-12T18:17:24.540", "references": [{"url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/pull/7971", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/pull/7972", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/releases/tag/2.83.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-841"}]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto. Desde la versi\u00f3n 2.75.0 hasta antes de la 2.83.2, las implementaciones de Fides que habilitan tanto la verificaci\u00f3n de identidad del interesado como la detecci\u00f3n de solicitudes de privacidad duplicadas se ven afectadas por una vulnerabilidad en la que un administrador puede aprobar una solicitud de privacidad cuya identidad nunca fue verificada. Para las pol\u00edticas de borrado, esto puede resultar en la eliminaci\u00f3n no autorizada de los registros de un interesado en todas las integraciones configuradas en la implementaci\u00f3n afectada. Esta vulnerabilidad se corrige en la versi\u00f3n 2.83.2."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}