PT-2026-34052 · Decidim · Decidim

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-40870

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions 0.0.1 through 0.30.4 Decidim versions 0.31.0 through 0.31.0

Description The root level commentable field in the API allows access to all commentable resources within the platform without permission checks. This occurs on instances where the '/api' endpoint is publicly available, which is the default configuration. If the platform protects private participation spaces, this may expose non-public data. For instances using the organization setting Force users to authenticate before access organization (introduced in version 0.19.0 and applied to the '/api' endpoint in version 0.22.0), the impact is limited to authenticated users.

Recommendations Update to version 0.30.5. Update to version 0.31.1. Limit access to the '/api' endpoint to authenticated users via custom code. Disable all traffic to the '/api' endpoint using custom configuration without allow statements.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40870

Affected Products

Decidim

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40870 · Security Note
• https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx · Note
• https://twitter.com/cypherbyteio/status/2046842689325265191 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046743408681636063 · Twitter Post