PT-2026-33228 · Decidim · Decidim

Published 2026-04-14 · Updated 2026-04-21 · CVE-2026-40869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions 0.19.0 through 0.30.4 Decidim versions 0.31.0 through 0.31.0

Description An issue allows any registered and authenticated user to accept or reject any amendments. This affects users who have created proposals with the amendments feature enabled. Furthermore, the user accepting the amendment is elevated to the author of the original proposal because individuals amending proposals are granted coauthorship on coauthorable resources.

Recommendations Update to version 0.30.5 or 0.31.1. As a temporary workaround, disable amendment reactions for the amendable component such as proposals.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-40869

GHSA-W5XJ-99CG-RCCM

Affected Products

Decidim

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-40869.yml · Exploit
• https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm · Patch
• https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40869 · Security Note
• https://osv.dev/vulnerability/GHSA-w5xj-99cg-rccm · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://twitter.com/VulmonFeeds/status/2046733169907355838 · Twitter Post