CVE-2023-48220 is a medium severity (CVSS 5.7) flaw in the devise_invitable Ruby gem, which Decidim depends on. Password reset accepts a pending invitation even after it has expired. Upgrade devise_invitable to 2.0.9 or later, or Decidim to 0.26.9, 0.27.5 or 0.28.0.
What's affected
The NVD record says that starting in devise_invitable 0.4.rc3 and prior to 2.0.9, the invites feature lets users accept an invitation for an unlimited time through the password reset functionality. The bug is in the gem, and it creates vulnerable dependencies in Decidim from 0.0.1.alpha3 up to but not including 0.26.9, 0.27.5 and 0.28.0, covering the decidim, decidim-admin and decidim-system gems.
The cause, in the record's words: when a user resets a password, devise_invitable always accepts the pending invitation if the user was invited. It checks that an invitation exists but not that it is still valid under the invite_for expiry period. Decidim sets that period to two weeks, so the setting was not being respected.
The fixed versions are devise_invitable 2.0.9 and above, and Decidim 0.26.9, 0.27.5 and 0.28.0. The Decidim 0.27.5 release notes list a backport titled "Bump devise_invitable from v2.0.8 to v2.0.9", which matches. The weakness is CWE-672 (Operation on a Resource after Expiration or Release).
The record scores it 5.7 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. It is not flagged as exploited in the wild.
How to check if you're exposed
For a Ruby application, read the lock file. Run these from the project root.
bundle list | grep -E "devise_invitable|decidim"
grep -nE "devise_invitable|decidim" Gemfile.lock
Anything with devise_invitable below 2.0.9 is affected, as is any Decidim release older than 0.26.9 on the 0.26 line, older than 0.27.5 on the 0.27 line, or any 0.28 pre-release. Any other app that uses devise_invitable directly is also in scope, not only Decidim.
Also look at your data. The record's workaround is to cancel invitations directly in the database, so check for users who were invited but never accepted, and decide whether those invitations should still stand.
What to do now
- Upgrade devise_invitable to 2.0.9 or later with
bundle update devise_invitable, and rebuild. - For Decidim, move to 0.26.9, 0.27.5 or 0.28.0, or later in the same line.
- Review pending invitations and cancel old ones, which the record gives as a workaround.
- Confirm in a test environment that an expired invitation can no longer be accepted through password reset.
- Add the gem to your dependency monitoring so future advisories match it automatically.
Why it matters
Two features overlap here: invitations that expire, and password reset. The reset path found a pending invitation and accepted it, skipping the age check that the sign in path applied. An old invitation that should have died after two weeks stayed usable.
The score is medium because the attack needs a high privilege context and a high complexity condition in the record vector, but the lesson reaches further. A security rule must hold on every route to the same outcome. When a flaw sits in a transitive dependency, your own code is correct and still exposed, which is why a full dependency inventory matters. See the Safeguard Gold page for this CVE and try the free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the bug in Decidim or in devise_invitable?
The record says the bug is in the devise_invitable gem. Decidim versions are listed because they depend on it.
What is the workaround if I cannot upgrade yet?
The record says invitations can be cancelled directly in the database.
Sources
Last reviewed: 19 October 2026.
