Decidim API Unauthorized Access via CVE-2026-40870

CVE-2026-40870 identifies a critical vulnerability within the Decidim participatory democracy framework. This flaw, affecting versions prior to 0.30.5 and 0.31.1, stems from the unrestricted access granted via the root level commentable field in the API. The absence of proper permission checks on the /api endpoint, which is, by default, publicly accessible, allows unauthenticated users to retrieve all commentable resources within the platform. Successful exploitation of this vulnerability could lead to unauthorized data exposure. All Decidim instances that have not secured their /api endpoint are vulnerable. The vulnerability was fixed in versions 0.30.5 and 0.31.1. Decidim versions 0.19.0 and later that have enabled the "Force users to authenticate before access organization" setting have limited the scope of the vulnerability to only authenticated users. Version 0.22.0 applied this to the /api endpoint.

Attack Chain

1. An unauthenticated attacker identifies a vulnerable Decidim instance with a publicly accessible /api endpoint.
2. The attacker sends a crafted HTTP GET request to the /api endpoint, targeting the root level commentable field.
3. Due to missing permission checks, the API processes the request without authentication.
4. The API retrieves data for all commentable resources within the Decidim platform.
5. The API returns the requested data in JSON format to the attacker.
6. The attacker parses the JSON response to extract sensitive information contained within the commentable resources.
7. Depending on the nature of the Decidim platform, this exposed data could include user details, internal discussions, or confidential documents.
8. The attacker uses the exfiltrated data for malicious purposes, such as identity theft or leaking private information.

Impact

Successful exploitation of CVE-2026-40870 can lead to the unauthorized disclosure of sensitive information stored within a Decidim platform. The severity of the impact depends on the data managed by the platform. While the vulnerability is less critical for platforms primarily serving public data, it poses a significant risk to those protecting private resources within participation spaces. Victims could experience reputational damage, privacy breaches, and potential legal repercussions. The number of affected Decidim instances is currently unknown, but any instance running a vulnerable version with a publicly accessible /api endpoint is at risk.

Recommendation

• Upgrade Decidim instances to version 0.30.5 or 0.31.1 or later to patch CVE-2026-40870.
• As a workaround, limit access to the /api endpoint to only authenticated users by implementing custom code or installing the Decidim::Apiauth module, as mentioned in the vulnerability description.
• For Decidim instances running version 0.19.0 or later, ensure the "Force users to authenticate before access organization" setting is enabled. This setting was applied to the /api endpoint in version 0.22.0.
• Deploy the Sigma rule "Detect Access to Decidim API Endpoint Without Authentication" to identify potential exploitation attempts.
• Monitor web server logs for suspicious requests to the /api endpoint (webserver logs).