CVE-2026-40869: Decidim amendments can be accepted or rejected by anyone
Impact The vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources.
The only check done when accepting or rejecting amendments is whether the amendment reactions are enabled for the component: https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107
The permission checks have been changed at 1b99136 which was introduced in released version 0.19.0. I have not investigated whether prior versions are also affected.
Patches
Not available
Workarounds Disable amendment reactions for the amendable component (e.g. proposals).
Other sources
Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40869?
CVE-2026-40869 holds a moderate severity level due to unauthorized access allowing users to accept or reject amendments.
How do I fix CVE-2026-40869?
To fix CVE-2026-40869, update the decidim-core package to version 0.30.6 or later or 0.31.2 or later.
Who is affected by CVE-2026-40869?
CVE-2026-40869 affects any users of Decidim who have proposals with the amendments feature enabled.
What actions can unauthorized users take in CVE-2026-40869?
Unauthorized users can accept or reject any amendments, compromising the integrity of the proposals.
Is authentication enough to protect against CVE-2026-40869?
No, mere authentication does not protect against CVE-2026-40869 as it allows any authenticated user to manipulate amendments.