CVE-2026-32700

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32700", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T14:33:42.823Z", "datePublished": "2026-03-18T20:55:55.034Z", "dateUpdated": "2026-03-20T18:11:56.909Z"}, "containers": {"cna": {"title": "Devise has a confirmable \"change email\" race condition that permits user to confirm email they have no access to", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc"}, {"name": "https://github.com/heartcombo/devise/issues/5783", "tags": ["x_refsource_MISC"], "url": "https://github.com/heartcombo/devise/issues/5783"}, {"name": "https://github.com/heartcombo/devise/pull/5784", "tags": ["x_refsource_MISC"], "url": "https://github.com/heartcombo/devise/pull/5784"}, {"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml", "tags": ["x_refsource_MISC"], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml"}], "affected": [{"vendor": "heartcombo", "product": "devise", "versions": [{"version": "< 5.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T20:55:55.034Z"}, "descriptions": [{"lang": "en", "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."}], "source": {"advisory": "GHSA-57hq-95w6-v4fc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/heartcombo/devise/issues/5783", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T17:35:55.837904Z", "id": "CVE-2026-32700", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T18:11:56.909Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32700", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T17:35:55.837904Z"}}}], "references": [{"url": "https://github.com/heartcombo/devise/issues/5783", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T17:14:02.915Z"}}], "cna": {"title": "Devise has a confirmable \"change email\" race condition that permits user to confirm email they have no access to", "source": {"advisory": "GHSA-57hq-95w6-v4fc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "heartcombo", "product": "devise", "versions": [{"status": "affected", "version": "< 5.0.3"}]}], "references": [{"url": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc", "name": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/heartcombo/devise/issues/5783", "name": "https://github.com/heartcombo/devise/issues/5783", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/heartcombo/devise/pull/5784", "name": "https://github.com/heartcombo/devise/pull/5784", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml", "name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T20:55:55.034Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32700", "state": "PUBLISHED", "dateUpdated": "2026-03-20T18:11:56.909Z", "dateReserved": "2026-03-13T14:33:42.823Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T20:55:55.034Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "devise", "vendor": "heartcombo", "versions": [{"status": "affected", "version": "< 5.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:heartcombo:devise:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "0B1D415E-F2DF-44BE-98F3-B7FD97B05D65", "versionEndExcluding": "5.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."}, {"lang": "es", "value": "Devise es una soluci\u00f3n de autenticaci\u00f3n para Rails basada en Warden. Antes de la versi\u00f3n 5.0.3, una condici\u00f3n de carrera en el m\u00f3dulo Confirmable de Devise permite a un atacante confirmar una direcci\u00f3n de correo electr\u00f3nico que no posee. Esto afecta a cualquier aplicaci\u00f3n Devise que utilice la opci\u00f3n 'reconfirmable' (la predeterminada al usar Confirmable con cambios de correo electr\u00f3nico). Al enviar dos solicitudes concurrentes de cambio de correo electr\u00f3nico, un atacante puede desincronizar los campos `confirmation_token` y `unconfirmed_email`. El token de confirmaci\u00f3n se env\u00eda a un correo electr\u00f3nico que el atacante controla, pero el `unconfirmed_email` en la base de datos apunta a la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima. Cuando el atacante utiliza el token, el correo electr\u00f3nico de la v\u00edctima se confirma en la cuenta del atacante. Esto est\u00e1 parcheado en Devise v5.0.3. Los usuarios deben actualizar lo antes posible. Como soluci\u00f3n alternativa, las aplicaciones pueden sobrescribir un m\u00e9todo espec\u00edfico de los modelos de Devise para forzar que `unconfirmed_email` se persista cuando no ha cambiado. Tenga en cuenta que Mongoid no parece respetar que `will_change!` deber\u00eda forzar que el atributo se persista, incluso si realmente no cambi\u00f3, por lo que el usuario podr\u00eda tener que implementar una soluci\u00f3n alternativa similar a Devise estableciendo `changed_attributes[\"unconfirmed_email\"] = nil` tambi\u00e9n."}], "id": "CVE-2026-32700", "lastModified": "2026-06-17T10:36:13.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32700", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T17:35:55.837904Z", "version": "2.0.3"}}]}, "published": "2026-03-18T21:16:26.943", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/heartcombo/devise/issues/5783"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/heartcombo/devise/pull/5784"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc"}, {"source": "security-advisories@github.com", "tags": ["Broken Link"], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking"], "url": "https://github.com/heartcombo/devise/issues/5783"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "devise: Devise: Unauthorized email confirmation due to a race condition", "id": "2448858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448858"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in Devise, an authentication solution for Rails. A race condition in the Confirmable module allows a remote attacker to confirm an email address they do not own. By sending two concurrent email change requests, an attacker can desynchronize the confirmation token and unconfirmed email fields. This enables the attacker to confirm a victim's email on their own account, potentially leading to unauthorized account manipulation."], "name": "CVE-2026-32700", "public_date": "2026-03-18T20:55:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32700\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32700\nhttps://github.com/heartcombo/devise/issues/5783\nhttps://github.com/heartcombo/devise/pull/5784\nhttps://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc\nhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml"], "statement": "This MODERATE race condition vulnerability in Devise's Confirmable module allows authenticated attackers to confirm emails they don't own. Exploitation requires high complexity (precise timing of concurrent requests) and a valid account. The scope change to S:C is questionable as the attack stays within Devise's auth boundary. Impact is high to confidentiality and integrity through unauthorized email association. Affects applications using reconfirmable (default). Fixed in Devise 5.0.3.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "devise", "source": "cna", "vendor": "heartcombo"}, "product": "devise", "vendor": "heartcombo"}], "analysis": {"en": {"generated_at": "2026-03-26T17:09:23.189582+00:00", "value": {"mitigation_remediation": ["Upgrade the Devise gem to version 5.0.3 or later.", "Run bundle install and restart the application.", "If an upgrade is not immediately possible, override the relevant method in your user model to force persistence of unchanged unconfirmed_email attributes.", "For Mongoid users, additionally set changed_attributes[\"unconfirmed_email\"] = nil to ensure the field is saved.", "Verify that the changes prevent the race condition by testing concurrent email change requests."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized email confirmation leading to potential account takeover"}, "threat_synthesis": {"affected_systems": "All Ruby on Rails applications using the Devise authentication framework before version 5.0.3 with the Confirmable module enabled and the default reconfirmable option. The affected package is the heartcombo:devise library shipped as a Ruby Gem.", "description_and_impact": "A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. By sending two concurrent email change requests, the attacker can desynchronize the confirmation_token and unconfirmed_email fields. The confirmation token is delivered to the attacker's mailbox while the unconfirmed_email in the database points to a victim\u2019s address. When the attacker uses the token, the victim\u2019s email is confirmed on the attacker\u2019s account, enabling unauthorized account use.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6 and an EPSS score below 1\u202f%, indicating moderate severity but low probability of exploitation. It is not listed in CISA\u2019s KEV catalog. The attack requires creating two simultaneous email change requests, typically from distinct accounts or timing the requests closely; therefore, the most likely attack surface is the web interface that allows users to change their email. Successful exploitation results in the attacker confirming an email they control on an account that belongs to a victim, potentially enabling further intrusion."}}}}, "created": "2026-03-19T08:55:28.509196+00:00", "updated": "2026-03-27T08:41:50.909092+00:00", "vendors": ["heartcombo", "heartcombo$PRODUCT$devise"]}