GHSA-w5xj-99cg-rccm CVE-2026-40869
Decidim amendments can be accepted or rejected by anyone
- Severity
- 7.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.22%
- Chance of exploitation in the next 30 days. Higher than 12.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-266 Incorrect Privilege Assignment
- Fix
0.31.1- Upgrade decidim-core to this version or later
Description
Impact
The vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources.
The only check done when accepting or rejecting amendments is whether the amendment reactions are enabled for the component: https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107
The permission checks have been changed at 1b99136 which was introduced in released version 0.19.0. I have not investigated whether prior versions are also affected.
Patches
Not available
Workarounds
Disable amendment reactions for the amendable component (e.g. proposals).
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| decidim-core | >= 0.31.0.rc1, < 0.31.1 |
0.31.1 |
| decidim-core | >= 0.19.0, < 0.30.5 |
0.30.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
decidim-core RubyGems → 0.31.1
- bundler
bundle update decidim-core # Gemfile: gem "decidim-core", ">= 0.31.1"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2g9c-vf8h-prxx Decidim: Push subscriptions can be abused for server-side requests | Medium | Also affects decidim-core |
| GHSA-533c-2vh9-4r86 Decidim: HTML content blocks allow stored script execution | Medium | Also affects decidim-core |
| GHSA-767h-63j4-5226 Decidim: Private exports can be downloaded through reusable links | Medium | Also affects decidim-core |
| GHSA-fc46-r95f-hq7g Decidim has a cross-site scripting (XSS) in user name | High | Also affects decidim-core |
| GHSA-3cx6-j9j4-54mp Decidim's private data exports can lead to data leaks | Medium | Also affects decidim-core |
| GHSA-9w99-78rj-hmxq Cross-site scripting (XSS) in the dynamic file uploads | Medium | Also affects decidim-core |
| GHSA-469h-mqg8-535r Decidim Cross-site Scripting vulnerability in the external link redirections | Medium | Also affects decidim-core |
| GHSA-5652-92r9-3fx9 Decidim Cross-site Scripting vulnerability in the processes filter | High | Also affects decidim-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor