CVE-2026-32700

RubyGems/devise CVE-2026-32700: medium 5.3, EPSS 0.35%

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

Action: Upgrade devise to 5.0.3 or later.

bundle update devise

Affected

Fixed versions

Sources

• osv: GHSA-57hq-95w6-v4fc
• https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc
• https://nvd.nist.gov/vuln/detail/CVE-2026-32700
• https://github.com/heartcombo/devise/issues/5783
• https://github.com/heartcombo/devise/pull/5784
• https://github.com/heartcombo/devise
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/CVE-2026-32700.yml
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml

CVE-2026-32700 · published 2026-03-17T17:24:17Z · modified 2026-03-30T14:05:52.117034Z · JSON