Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.
Summary
Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ethyca | fides | 2.75.0 to before 2.83.2 | 2.83.2 | Patch available | CNA |
| — | ethyca-fides (PyPI) | 2.75.0 to before 2.83.2 | 2.83.2 | Patch available | GHSA-qx5f-ghc2-7g5c |
- fides Vendorethyca Affected 2.75.0 to before 2.83.2 Fixed in 2.83.2 Patch available CNA
- ethyca-fides (PyPI) Vendor— Affected 2.75.0 to before 2.83.2 Fixed in 2.83.2 Patch available GHSA-qx5f-ghc2-7g5c
Remediation
- Fix · CNA fides (ethyca) Fixed in 2.83.2
- Fix · GHSA-qx5f-ghc2-7g5c ethyca-fides (PyPI) Fixed in 2.83.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42303
- 2026-10-03 Alias added: GHSA-qx5f-ghc2-7g5c
References
Other 7
- https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c
- https://github.com/ethyca/fides/pull/7971
- https://github.com/ethyca/fides/pull/7972
- https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37
- https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd
- https://github.com/ethyca/fides/releases/tag/2.83.2
- https://github.com/ethyca/fides
More ethyca vulnerabilities
- TI-2024-30165 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine CVSS 3.1CRITICAL 9.1
- TI-2026-32453 Fides: DOM-based XSS vulnerability in fides.js via fides_description override CVSS 4.0HIGH 7.0
- TI-2024-30164 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability CVSS 3.1MEDIUM 5.3
- TI-2024-20599 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVSS 3.1MEDIUM 5.3
- TI-2024-23262 Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides CVSS 3.1MEDIUM 6.5
- TI-2023-26088 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-42303 · CVE Program
- CVE-2026-42303 · NVD
- FIRST EPSS
- GHSA-qx5f-ghc2-7g5c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences