Decidim - CraftedSignal Threat Feed

Decidim API Unauthorized Access via CVE-2026-40870

hello@craftedsignal.io — Tue, 30 Jan 2024 12:00:00 +0000

CVE-2026-40870 identifies a critical vulnerability within the Decidim participatory democracy framework. This flaw, affecting versions prior to 0.30.5 and 0.31.1, stems from the unrestricted access granted via the root level commentable field in the API. The absence of proper permission checks on the /api endpoint, which is, by default, publicly accessible, allows unauthenticated users to retrieve all commentable resources within the platform. Successful exploitation of this vulnerability could lead to unauthorized data exposure. All Decidim instances that have not secured their /api endpoint are vulnerable. The vulnerability was fixed in versions 0.30.5 and 0.31.1. Decidim versions 0.19.0 and later that have enabled the "Force users to authenticate before access organization" setting have limited the scope of the vulnerability to only authenticated users. Version 0.22.0 applied this to the /api endpoint.

Attack Chain

An unauthenticated attacker identifies a vulnerable Decidim instance with a publicly accessible /api endpoint.
The attacker sends a crafted HTTP GET request to the /api endpoint, targeting the root level commentable field.
Due to missing permission checks, the API processes the request without authentication.
The API retrieves data for all commentable resources within the Decidim platform.
The API returns the requested data in JSON format to the attacker.
The attacker parses the JSON response to extract sensitive information contained within the commentable resources.
Depending on the nature of the Decidim platform, this exposed data could include user details, internal discussions, or confidential documents.
The attacker uses the exfiltrated data for malicious purposes, such as identity theft or leaking private information.

Impact

Successful exploitation of CVE-2026-40870 can lead to the unauthorized disclosure of sensitive information stored within a Decidim platform. The severity of the impact depends on the data managed by the platform. While the vulnerability is less critical for platforms primarily serving public data, it poses a significant risk to those protecting private resources within participation spaces. Victims could experience reputational damage, privacy breaches, and potential legal repercussions. The number of affected Decidim instances is currently unknown, but any instance running a vulnerable version with a publicly accessible /api endpoint is at risk.

Recommendation

Upgrade Decidim instances to version 0.30.5 or 0.31.1 or later to patch CVE-2026-40870.
As a workaround, limit access to the /api endpoint to only authenticated users by implementing custom code or installing the Decidim::Apiauth module, as mentioned in the vulnerability description.
For Decidim instances running version 0.19.0 or later, ensure the "Force users to authenticate before access organization" setting is enabled. This setting was applied to the /api endpoint in version 0.22.0.
Deploy the Sigma rule "Detect Access to Decidim API Endpoint Without Authentication" to identify potential exploitation attempts.
Monitor web server logs for suspicious requests to the /api endpoint (webserver logs).

Decidim Amendment Acceptance Vulnerability

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Decidim is an open-source participatory democracy framework. A vulnerability exists within Decidim versions 0.19.0 through 0.30.5 and 0.31.0.rc1 through 0.31.1 where any authenticated user can accept or reject amendments to proposals, regardless of their authorization. This issue stems from insufficient permission checks when handling amendment reactions within the affected Decidim components. Successful exploitation allows an attacker to manipulate proposal content and gain co-author status, potentially influencing the outcome of participatory processes. There are currently no patches available; the identified workaround involves disabling amendment reactions for components using the amendable feature. This vulnerability was reported on GitHub as GHSA-w5xj-99cg-rccm.

Attack Chain

Attacker registers an account on the Decidim platform.
Attacker authenticates to the Decidim platform with their registered account.
Attacker identifies a proposal with the amendments feature enabled.
Attacker crafts a malicious HTTP request to the /amendments/{amendment_id}/accept or /amendments/{amendment_id}/reject endpoint.
The Decidim application processes the request without proper authorization checks due to the vulnerability in decidim/permissions.rb.
The amendment is accepted or rejected based on the attacker's request.
If the amendment is accepted, the attacker is granted co-author status on the proposal.
Attacker leverages co-author status to influence or control the proposal.

Impact

This vulnerability can compromise the integrity of participatory processes managed by Decidim. By exploiting the vulnerability, an attacker can manipulate proposals and gain undue influence, potentially undermining the democratic process. Impacts can range from subtle alterations of proposal content to complete control over proposal outcomes. The number of affected proposals depends on the number of Decidim installations using the vulnerable versions and having the amendment feature enabled.

Recommendation

Apply the provided workaround by disabling amendment reactions for the amendable component (e.g., proposals) to mitigate the vulnerability until a patch is available (reference: Workarounds section).
Monitor Decidim application logs for suspicious activity related to amendment acceptance/rejection actions originating from unauthorized users. Implement a detection rule focusing on HTTP POST requests to /amendments/{amendment_id}/accept and /amendments/{amendment_id}/reject (reference: Sigma rule - Decidim Suspicious Amendment Activity).
Upgrade to a patched version of Decidim-core once available to remediate the vulnerability. Check the Decidim release notes for updates (reference: Affected Packages section).

Decidim Amendment Manipulation Vulnerability (CVE-2026-40869)

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

Decidim is an open-source participatory democracy framework used by organizations to facilitate online discussions and decision-making. A vulnerability, CVE-2026-40869, affects Decidim versions 0.19.0 prior to 0.30.5 and 0.31.1. This flaw allows any registered and authenticated user to accept or reject amendments to proposals, even if they are not the original author. This can lead to unauthorized modification of proposals and the elevation of malicious users to co-authorship status, potentially undermining the integrity of the participatory process. The vulnerability was reported on 2026-04-21. Organizations using vulnerable versions of Decidim are at risk of having their proposals manipulated and their decision-making processes subverted.

Attack Chain

Attacker registers an account on the Decidim platform.
Attacker authenticates to the Decidim platform using their registered credentials.
Attacker identifies a proposal with the "amendments" feature enabled.
Attacker views the available amendments for the target proposal through the web interface (HTTP GET request to view amendment details).
Attacker crafts a malicious HTTP POST request to either accept or reject an amendment, bypassing intended authorization checks.
The Decidim application incorrectly processes the attacker's request, allowing the attacker to modify the amendment's status.
If the attacker accepts the amendment, they may be elevated to co-authorship of the original proposal.
The altered amendment status is reflected on the Decidim platform, potentially influencing voting or decision-making processes.

Impact

Successful exploitation of CVE-2026-40869 allows any registered user to manipulate amendments within Decidim proposals. This can lead to unauthorized modifications, data tampering, and the potential for a malicious actor to hijack the authorship of proposals. The number of affected organizations depends on the adoption rate of vulnerable Decidim versions. If successful, this can erode trust in the platform, manipulate democratic processes, and ultimately undermine the organization's decision-making capabilities.

Recommendation

Upgrade Decidim to version 0.30.5 or 0.31.1 to patch CVE-2026-40869.
As a temporary workaround, disable amendment reactions for amendable components within Decidim, as recommended in the vulnerability description.
Monitor Decidim web server logs for suspicious POST requests to amendment endpoints originating from unusual IP addresses using the provided Sigma rule.
Implement the Sigma rule to detect unauthorized amendment modifications based on HTTP request parameters.