Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

The core of the vulnerability lies in a desynchronization issue between the confirmationtoken and unconfirmedemail fields within the Devise database. An attacker can exploit this by sending two concurrent email change requests. The first request triggers the generation and sending of a confirmation token to an email address controlled by the attacker. Simultaneously, the second request updates the unconfirmed_email field in the database to point to a victim's email address. When the attacker subsequently uses the confirmation token, the system incorrectly confirms the victim's email address, effectively granting the attacker control over the victim's account. This could lead to unauthorized access to sensitive data, modification of user profiles, and potentially further compromise of the application.

Applications built with Ruby on Rails that utilize the Devise authentication gem and specifically enable the reconfirmable option in the Confirmable module are at risk. This includes applications that allow users to change their email addresses and rely on email confirmation for verification. Shared hosting environments where multiple applications share the same database may also be vulnerable if one application is running an older, vulnerable version of Devise.

• ruby / rails:

# Check Devise version
require 'devise'
presence = Devise.presence
puts "Devise version: #{Devise.version}" if presence

• generic web:

grep -r 'Devise.confirmable?' app/models/**/*.rb

• generic web:

curl -I https://your-rails-app.com/confirmations/new | grep -i devise

1. 2026-03-17Disclosure

   disclosure

1. आरक्षित2026-03-13
2. प्रकाशित2026-03-17
3. संशोधित2026-03-30
4. EPSS अद्यतन2026-03-26

The primary mitigation for CVE-2026-32700 is to upgrade to Devise version 5.0.3 or later, which contains the fix for the race condition. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing a temporary workaround by adding a unique constraint on the unconfirmed_email field in the database. This will prevent concurrent updates to the same email address, mitigating the race condition. Additionally, monitor application logs for suspicious activity, such as multiple email confirmation requests originating from the same IP address within a short timeframe. After upgrading, confirm the fix by attempting to trigger the race condition manually and verifying that the email confirmation process behaves as expected.