Skip to content
Threat Feed
Subscribe

Product

Decidim

2 briefs RSS
high advisory

Decidim API Unauthorized Access via CVE-2026-40870

CVE-2026-40870 allows unauthenticated access to commentable resources in Decidim platforms prior to versions 0.30.5 and 0.31.1 due to missing permission checks on the publicly accessible `/api` endpoint, potentially exposing sensitive data.

Decidim cve-2026-40870 api unauthorized-access
2r 1t 1c
medium advisory

Decidim Amendment Manipulation Vulnerability (CVE-2026-40869)

CVE-2026-40869 allows authenticated users to manipulate amendments in Decidim versions 0.19.0 prior to 0.30.5 and 0.31.1, potentially hijacking authorship and impacting proposal integrity.

Decidim vulnerability amendment manipulation
2r 1t 1c