CVE-2026-42303

May 13, 2026, 6:24 p.m.

6.1
Medium

Description

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Product(s) Impacted

Vendor Product Versions
Fides
  • Fides
  • 2.75.0-2.83.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a fides fides 2.75.0-2.83.2 / / / / / / /

References

https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37
https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd
https://github.com/ethyca/fides/pull/7971
https://github.com/ethyca/fides/pull/7972
https://github.com/ethyca/fides/releases/tag/2.83.2
https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c
https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c

Tags

[email protected]
CWE-288
2026-05-12
CVE-2026-42303

CVSS Score

6.1 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: ACTIVE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: May 12, 2026, 6:17 p.m.
Last Modified: May 13, 2026, 6:24 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.