CVE-2026-42303

{
  "id": "CVE-2026-42303",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:17:24.540",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2."
    },
    {
      "lang": "es",
      "value": "Fides es una plataforma de ingeniería de privacidad de código abierto. Desde la versión 2.75.0 hasta antes de la 2.83.2, las implementaciones de Fides que habilitan tanto la verificación de identidad del interesado como la detección de solicitudes de privacidad duplicadas se ven afectadas por una vulnerabilidad en la que un administrador puede aprobar una solicitud de privacidad cuya identidad nunca fue verificada. Para las políticas de borrado, esto puede resultar en la eliminación no autorizada de los registros de un interesado en todas las integraciones configuradas en la implementación afectada. Esta vulnerabilidad se corrige en la versión 2.83.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ethyca",
          "product": "fides",
          "versions": [
            {
              "version": ">= 2.75.0, < 2.83.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T18:39:40.374950Z",
          "id": "CVE-2026-42303",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-841"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/pull/7971",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/pull/7972",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/releases/tag/2.83.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}