CVE-2026-42303
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Fides from 2.75.0 to before 2.83.2, deployments enabling both subject identity verification and duplicate privacy request detection allow an administrator to approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across all integrations.
Risk Assessment
Unauthorized approval of a request could lead to mass deletion of personal data, a serious privacy and compliance breach.
Recommendation
Update Fides to version 2.83.2 or later and review the approval workflow for erasure requests.
Other vulnerabilities in Fides
Original NVD description (English source)
Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS