Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to

CVE-2026-32700 is a race condition in the Devise authentication library's Confirmable module, specifically affecting the reconfirmable option used for email changes. The vulnerability allows an attacker to confirm an email address they do not control, enabling them to link a victim's email to their own account [2].

To exploit this, an attacker sends two concurrent HTTP requests to change the email on their account: one to an attacker-controlled address and another to the victim's address. Due to a race condition, the confirmation_token is sent to the attacker's email while the unconfirmed_email field in the database is set to the victim's address. The attacker can then use the token to confirm the victim's email on the attacker's account [3].

The impact is that the attacker gains the ability to associate a victim's email with their own account, potentially leading to account takeover or other security breaches if the email is used for password resets or notifications [2]. The vulnerability affects all Devise applications using the default reconfirmable setting with the Confirmable module.

Devise v5.0.3 patches this issue by ensuring that unconfirmed_email is forcefully persisted even when unchanged. Users should upgrade immediately. As a workaround, applications can override methods to force the attribute to be updated in the database, though Mongoid ORM may require additional steps [2][1].