{"action":"Upgrade devise_invitable to 2.0.9 or later.","affected":[{"fixed":"2.0.9","introduced":"0.4.rc3"}],"component":"devise_invitable","cve_ids":["CVE-2023-48220"],"ecosystem":"RubyGems","epss":0.00791,"exploited":false,"fixed_versions":["2.0.9"],"ghsa_id":"GHSA-w3q8-m492-4pwp","id":"tcs_01M5KENSBRKRM04PGFHNHAAKXV","modified_at":"2026-09-10T03:50:00.851414970Z","published_at":"2024-02-20T19:26:51Z","references":["https://osv.dev/vulnerability/GHSA-w3q8-m492-4pwp","https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp","https://nvd.nist.gov/vuln/detail/CVE-2023-48220","https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34","https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454","https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098","https://github.com/decidim/decidim","https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134","https://github.com/decidim/decidim/releases/tag/v0.26.9","https://github.com/decidim/decidim/releases/tag/v0.27.5","https://github.com/decidim/decidim/releases/tag/v0.28.0","https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-w3q8-m492-4pwp#RubyGems/devise_invitable","url":"https://osv.dev/vulnerability/GHSA-w3q8-m492-4pwp"}],"summary":"Possibility to circumvent the invitation token expiry period"}