CVE-2026-42303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42303", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T12:13:55.552Z", "datePublished": "2026-05-12T17:29:22.285Z", "dateUpdated": "2026-05-12T18:40:09.815Z"}, "containers": {"cna": {"title": "Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection", "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-841", "lang": "en", "description": "CWE-841: Improper Enforcement of Behavioral Workflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c"}, {"name": "https://github.com/ethyca/fides/pull/7971", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/pull/7971"}, {"name": "https://github.com/ethyca/fides/pull/7972", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/pull/7972"}, {"name": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37"}, {"name": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd"}, {"name": "https://github.com/ethyca/fides/releases/tag/2.83.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/releases/tag/2.83.2"}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"version": ">= 2.75.0, < 2.83.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:29:22.285Z"}, "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2."}], "source": {"advisory": "GHSA-qx5f-ghc2-7g5c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T18:39:40.374950Z", "id": "CVE-2026-42303", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:40:09.815Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42303", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T18:39:40.374950Z"}}}], "references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:39:06.577Z"}}], "cna": {"title": "Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection", "source": {"advisory": "GHSA-qx5f-ghc2-7g5c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": ">= 2.75.0, < 2.83.2"}]}], "references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "name": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ethyca/fides/pull/7971", "name": "https://github.com/ethyca/fides/pull/7971", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ethyca/fides/pull/7972", "name": "https://github.com/ethyca/fides/pull/7972", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37", "name": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd", "name": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ethyca/fides/releases/tag/2.83.2", "name": "https://github.com/ethyca/fides/releases/tag/2.83.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841: Improper Enforcement of Behavioral Workflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:29:22.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42303", "state": "PUBLISHED", "dateUpdated": "2026-05-12T18:40:09.815Z", "dateReserved": "2026-04-26T12:13:55.552Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T17:29:22.285Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fides", "vendor": "ethyca", "versions": [{"status": "affected", "version": ">= 2.75.0, < 2.83.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto. Desde la versi\u00f3n 2.75.0 hasta antes de la 2.83.2, las implementaciones de Fides que habilitan tanto la verificaci\u00f3n de identidad del interesado como la detecci\u00f3n de solicitudes de privacidad duplicadas se ven afectadas por una vulnerabilidad en la que un administrador puede aprobar una solicitud de privacidad cuya identidad nunca fue verificada. Para las pol\u00edticas de borrado, esto puede resultar en la eliminaci\u00f3n no autorizada de los registros de un interesado en todas las integraciones configuradas en la implementaci\u00f3n afectada. Esta vulnerabilidad se corrige en la versi\u00f3n 2.83.2."}], "id": "CVE-2026-42303", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42303", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T18:39:40.374950Z", "version": "2.0.3"}}]}, "published": "2026-05-12T18:17:24.540", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/pull/7971"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/pull/7972"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/releases/tag/2.83.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-841"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.75.0,2.83.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fides", "source": "cna", "vendor": "ethyca"}, "product": "fides", "vendor": "ethyca"}], "created": "2026-05-12T20:00:13.494930+00:00", "updated": "2026-05-12T23:30:26.340938+00:00", "vendors": ["ethyca", "ethyca$PRODUCT$fides"]}