CVE-2026-32700: Devise Email Change Race Condition Vulnerability
Summary
CVE-2026-32700: Impact A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. Affects devise versions < 5.0.3. Fixed in 5.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Devise is a flexible authentication solution for Rails based on Warden. It provides a range of features including user registration, password recovery, and email confirmation. One of its key modules, Confirmable, is designed to ensure that users confirm their email addresses. However, a flaw in the Confirmable module allows for a race condition when changing email addresses, particularly when the reconfirmable option is enabled, which is the default behavior.
Vulnerability Detail
A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This vulnerability arises when an attacker sends two concurrent email change requests. This can lead to a desynchronization of the confirmation_token and unconfirmed_email fields in the database. The attacker controls the confirmation token sent to their email, while the unconfirmed_email field points to the victim's email. When the attacker uses the token, the victim's email is confirmed on the attacker's account, leading to unauthorized access.
How To Fix
Latest published version: 5.0.4 as of 22 Oct 2026
gem install devise -v 5.0.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.3
This is the first release that contains the fix.
gem install devise -v 5.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can implement a workaround by overriding a specific method in your Devise model. For example, if your model is User, you can add the following code:
class User < ApplicationRecord
protected
def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
unconfirmed_email_will_change!
super
end
end
Note: If you are using Mongoid, you may need to implement an additional workaround to ensure that the unconfirmed_email attribute is persisted correctly.
Conclusion
The CVE-2026-32700 vulnerability in Devise poses a significant risk by allowing unauthorized email confirmations through a race condition. It is crucial for users to upgrade to version 5.0.3 or implement the suggested workaround to protect their applications from potential exploitation.
See every vulnerability recorded for devise →
FAQ
The vulnerability is a race condition that allows an attacker to confirm an email address they do not own by exploiting concurrent email change requests.
All versions of Devise prior to 5.0.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application by using the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
If an immediate upgrade is not possible, implement the provided workaround in your Devise model to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for devise.
