CVE-2026-32700

{"id": "CVE-2026-32700", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-18T21:16:26.943", "references": [{"url": "https://github.com/heartcombo/devise/issues/5783", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/heartcombo/devise/pull/5784", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml", "tags": ["Broken Link"], "source": "security-advisories@github.com"}, {"url": "https://github.com/heartcombo/devise/issues/5783", "tags": ["Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."}, {"lang": "es", "value": "Devise es una soluci\u00f3n de autenticaci\u00f3n para Rails basada en Warden. Antes de la versi\u00f3n 5.0.3, una condici\u00f3n de carrera en el m\u00f3dulo Confirmable de Devise permite a un atacante confirmar una direcci\u00f3n de correo electr\u00f3nico que no posee. Esto afecta a cualquier aplicaci\u00f3n Devise que utilice la opci\u00f3n 'reconfirmable' (la predeterminada al usar Confirmable con cambios de correo electr\u00f3nico). Al enviar dos solicitudes concurrentes de cambio de correo electr\u00f3nico, un atacante puede desincronizar los campos `confirmation_token` y `unconfirmed_email`. El token de confirmaci\u00f3n se env\u00eda a un correo electr\u00f3nico que el atacante controla, pero el `unconfirmed_email` en la base de datos apunta a la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima. Cuando el atacante utiliza el token, el correo electr\u00f3nico de la v\u00edctima se confirma en la cuenta del atacante. Esto est\u00e1 parcheado en Devise v5.0.3. Los usuarios deben actualizar lo antes posible. Como soluci\u00f3n alternativa, las aplicaciones pueden sobrescribir un m\u00e9todo espec\u00edfico de los modelos de Devise para forzar que `unconfirmed_email` se persista cuando no ha cambiado. Tenga en cuenta que Mongoid no parece respetar que `will_change!` deber\u00eda forzar que el atributo se persista, incluso si realmente no cambi\u00f3, por lo que el usuario podr\u00eda tener que implementar una soluci\u00f3n alternativa similar a Devise estableciendo `changed_attributes[\"unconfirmed_email\"] = nil` tambi\u00e9n."}], "lastModified": "2026-03-26T14:47:09.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:heartcombo:devise:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "0B1D415E-F2DF-44BE-98F3-B7FD97B05D65", "versionEndExcluding": "5.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}