p PatchFirst

CVE-2026-42303

CVE-2026-42303 · Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

CVSS 6.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • fides

    Versions
    • >= 2.75.0, < 2.83.2: Affected

    No fix published

  • ethyca-fides PyPI

    Versions
    • 2.75.0
    • 2.75.1
    • 2.75.1rc0
    • 2.75.2
    • 2.75.2rc0
    • 2.75.3b0
    • 2.76.0
    • 2.76.0rc0
    • 2.76.0rc1
    • 2.76.0rc2
    • 2.76.0rc3
    • 2.76.1
    • 2.76.1rc0
    • 2.76.1rc1
    • 2.76.2a10
    • 2.76.2a12
    • 2.77.0
    • 2.77.0rc0
    • 2.77.0rc2
    • 2.77.0rc3
    • 2.77.0rc4
    • 2.77.0rc5
    • 2.77.0rc6
    • 2.77.0rc7
    • 2.77.1
    • 2.77.1a0
    • 2.77.1rc0
    • 2.77.1rc1
    • 2.77.2a0
    • 2.77.2a1
    • 2.77.2a2
    • 2.77.2a3
    • 2.77.2a4
    • 2.77.2a5
    • 2.77.2a9
    • 2.77.2b0
    • 2.77.2b1
    • 2.78.0
    • 2.78.0rc0
    • 2.78.0rc1
    • 2.78.0rc2
    • 2.78.0rc3
    • 2.78.0rc4
    • 2.78.0rc6
    • 2.78.0rc7
    • 2.78.0rc8
    • 2.78.1
    • 2.78.1rc0
    • 2.78.2
    • 2.78.2a0
    • 2.78.2rc0
    • 2.78.3a2
    • 2.78.3a3
    • 2.78.3b0
    • 2.78.3b1
    • 2.79.0
    • 2.79.0rc0
    • 2.79.0rc1
    • 2.79.0rc2
    • 2.79.0rc3
    • 2.79.0rc4
    • 2.79.0rc6
    • 2.79.1a0
    • 2.79.1a1
    • 2.79.1a2
    • 2.79.1a3
    • 2.79.1a4
    • 2.79.1a5
    • 2.79.1a6
    • 2.80.0
    • 2.80.0rc0
    • 2.80.0rc1
    • 2.80.0rc10
    • 2.80.0rc2
    • 2.80.0rc3
    • 2.80.0rc4
    • 2.80.0rc5
    • 2.80.0rc6
    • 2.80.0rc7
    • 2.80.0rc8
    • 2.80.0rc9
    • 2.80.1
    • 2.80.1a0
    • 2.80.1a1
    • 2.80.1rc0
    • 2.80.1rc1
    • 2.80.2a0
    • 2.80.2a1
    • 2.80.2a2
    • 2.81.0
    • 2.81.0rc0
    • 2.81.0rc1
    • 2.81.0rc2
    • 2.81.0rc3
    • 2.81.1
    • 2.81.1a0
    • 2.81.1a1
    • 2.81.1a2
    • 2.81.1b0
    • 2.81.1rc0
    • 2.81.2a0
    • 2.81.2a1
    • 2.81.2a2
    • 2.81.2b0
    • 2.81.2b1
    • 2.82.0
    • 2.82.0rc0
    • 2.82.0rc1
    • 2.82.0rc2
    • 2.82.0rc3
    • 2.82.0rc4
    • 2.82.0rc5
    • 2.82.0rc6
    • 2.82.0rc8
    • 2.82.1
    • 2.82.1b0
    • 2.82.1b1
    • 2.82.1rc0
    • 2.82.2
    • 2.82.2a0
    • 2.82.2a1
    • 2.82.2a2
    • 2.82.2rc0
    • 2.82.2rc1
    • 2.83.0
    • 2.83.0rc0
    • 2.83.0rc1
    • 2.83.0rc2
    • 2.83.0rc3
    • 2.83.0rc4
    • 2.83.0rc5
    • 2.83.0rc6
    • 2.83.1
    • 2.83.1a0
    • 2.83.1a1
    • 2.83.1a2
    • 2.83.1b0
    • 2.83.1rc0
    • 2.83.2a0
    • 2.83.2a1
    • 2.83.2rc0
    • 2.83.2rc1
    • 2.83.2rc2
    • 2.83.2rc3
    Affected ranges
    • ECOSYSTEM: ≥ 2.75.0, < 2.83.2

    Update to 2.83.2

Original sources

Check your server →