CVE-2026-42303: Ethyca Fides

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.

Affected products

• Ethyca Fides: from 2.75.0, before 2.83.2 (fixed in 2.83.2)

Published 2026-05-12. Last modified 2026-06-17.