CVE Feed

    Dashboard / CVE / CVE-2026-40869

    CVE-2026-40869

    Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).

    Published:Apr 21, 2026
    Last Modified:Apr 23, 2026
    EPS:Apr 21, 2026
    EPSS Score:0.00028
    CVSS Score:7.5

    Affected Products

    Vendor
    Decidim
    Product
    Decidim

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-266 Incorrect Privilege Assignment

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-45378 (CVSS 7.5) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45573 (CVSS 6.4) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45572 (CVSS 4.8) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45415 (CVSS 6) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45414 (CVSS 8.5) — Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backe…
    CVE-2026-45377 (CVSS 6.5) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45376 (CVSS 5.5) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45330 (CVSS 4.9) — Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 …
    CVE-2026-45086 (CVSS 5.4) — Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2,…
    CVE-2026-40870 (CVSS 7.5) — Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.3…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High