CVE-2026-42303

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Summary

Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment.

A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.

Am I affected?

This vulnerability only affects deployments that use Fides's privacy request (data subject request) features, also known collectively as "Lethe". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.

Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to true:

• subject_identity_verification_required
• privacy_request_duplicate_detection.enabled

Both settings default to false.

Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:

1. Admin UI / configuration API - stored in the application database and applied at runtime
2. Environment variables - read at webserver startup
3. fides.toml - read at webserver startup
4. Default value - used if none of the above set the value

To determine whether your deployment is affected, check each setting in every location that applies to your configuration management.

subject_identity_verification_required

• fides.toml: under the [execution] section as subject_identity_verification_required = true
• Environment variable: FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true
• No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API

privacy_request_duplicate_detection.enabled

• fides.toml: under the [privacy_request_duplicate_detection] section as enabled = true
• Environment variable: FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true
• Admin UI: Settings → Privacy requests → Duplicate detection, via the "Enable duplicate detection" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via fides.toml or environment variable will not appear here.

<figure> <img width="1392" height="940" alt="GHSA - Duplicate Detection Enabled" src="https://github.com/user-attachments/assets/e384f273-ce68-403c-adb2-93536eca5f3a" /> <figcaption> <em> The "Enable duplicate detection" toggle when it's enabled, under Settings → Privacy requests in the Admin UI. </em> </figcaption> </figure>

Details

When duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.

An attacker exploits this by submitting two privacy requests using a target's email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.

The fix for this vulnerability also patches a lower-severity issue, present in versions 2.82.0 through 2.83.1, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.

Impact

…

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Summary

Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment.

A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.

Am I affected?

This vulnerability only affects deployments that use Fides's privacy request (data subject request) features, also known collectively as "Lethe". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.

Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to true:

• subject_identity_verification_required
• privacy_request_duplicate_detection.enabled

Both settings default to false.

Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:

1. Admin UI / configuration API - stored in the application database and applied at runtime
2. Environment variables - read at webserver startup
3. fides.toml - read at webserver startup
4. Default value - used if none of the above set the value

To determine whether your deployment is affected, check each setting in every location that applies to your configuration management.

subject_identity_verification_required

• fides.toml: under the [execution] section as subject_identity_verification_required = true
• Environment variable: FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true
• No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API

privacy_request_duplicate_detection.enabled

• fides.toml: under the [privacy_request_duplicate_detection] section as enabled = true
• Environment variable: FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true
• Admin UI: Settings → Privacy requests → Duplicate detection, via the "Enable duplicate detection" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via fides.toml or environment variable will not appear here.

<figure> <img width="1392" height="940" alt="GHSA - Duplicate Detection Enabled" src="https://github.com/user-attachments/assets/e384f273-ce68-403c-adb2-93536eca5f3a" /> <figcaption> <em> The "Enable duplicate detection" toggle when it's enabled, under Settings → Privacy requests in the Admin UI. </em> </figcaption> </figure>

Details

When duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.

An attacker exploits this by submitting two privacy requests using a target's email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.

The fix for this vulnerability also patches a lower-severity issue, present in versions 2.82.0 through 2.83.1, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.

Impact

…

Summary

Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment.

A related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.

Am I affected?

This vulnerability only affects deployments that use Fides's privacy request (data subject request) features, also known collectively as "Lethe". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.

Within deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to true:

• subject_identity_verification_required
• privacy_request_duplicate_detection.enabled

Both settings default to false.

Each setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:

1. Admin UI / configuration API - stored in the application database and applied at runtime
2. Environment variables - read at webserver startup
3. fides.toml - read at webserver startup
4. Default value - used if none of the above set the value

To determine whether your deployment is affected, check each setting in every location that applies to your configuration management.

subject_identity_verification_required

• fides.toml: under the [execution] section as subject_identity_verification_required = true
• Environment variable: FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true
• No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API

privacy_request_duplicate_detection.enabled

• fides.toml: under the [privacy_request_duplicate_detection] section as enabled = true
• Environment variable: FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true
• Admin UI: Settings → Privacy requests → Duplicate detection, via the "Enable duplicate detection" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via fides.toml or environment variable will not appear here.

<figure> <img width="1392" height="940" alt="GHSA - Duplicate Detection Enabled" src="https://github.com/user-attachments/assets/e384f273-ce68-403c-adb2-93536eca5f3a" /> <figcaption> <em> The "Enable duplicate detection" toggle when it's enabled, under Settings → Privacy requests in the Admin UI. </em> </figcaption> </figure>

Details

When duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.

An attacker exploits this by submitting two privacy requests using a target's email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.

The fix for this vulnerability also patches a lower-severity issue, present in versions 2.82.0 through 2.83.1, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.

Impact

…