Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

Impact

The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.

Patches

The problem was patched in v0.27.3 and v0.26.7

Impact The vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources.

The only check done when accepting or rejecting amendments is whether the amendment reactions are enabled for the component: https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107

The permission checks have been changed at 1b99136 which was introduced in released version 0.19.0. I have not investigated whether prior versions are also affected.

Patches

Not available

Workarounds Disable amendment reactions for the amendable component (e.g. proposals).

Impact A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.

Patches N/A

Workarounds Not available

References OWASP ASVS v4.0.3-5.1.3

Credits This issue was discovered in a security audit organized by octree and made by Secu Labs against Decidim financed by the city of Lausanne (Switzerland).

Impact Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs.

The bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23).

This issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug:

bash $ cd decidim-core $ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/downloadyourdataexportjobspec.rb -e "deletes the" || break ; done

Run the spec as many times as needed to hit a UUID that converts to 0 through .toi.

The UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example.

The following code regenerates the issue by assigning a predefined UUID that will generate a collision (example assumes there are already two existing users in the system):

ruby Create the ZIP buffers to be stored buffer1 = Zip::OutputStream.writebuffer do |out| out.putnextentry("admin.txt") out.write "Hello, admin!" end buffer1.rewind buffer2 = Zip::OutputStream.writebuffer do |out| out.putnextentry("user.txt") out.write "Hello, user!" end buffer2.rewind

Create the private exports with a predefined IDs user1 = Decidim::User.find(1) export = user1.privateexports.build export.id = "0210ae70-482b-4671-b758-35e13e0097a9" export.exporttype = "downloadyourdata" export.file.attach(io: buffer1, filename: "foobar.zip", contenttype: "application/zip") export.expiresat = Decidim.downloadyourdataexpirytime.fromnow export.metadata = {} export.save!

user2 = Decidim::User.find(2) export = user2.privateexports.build export.id = "0210d2df-a0c7-40aa-ad97-2dae5083e3b8" export.exporttype = "downloadyourdata" export.file.attach(io: buffer2, filename: "foobar.zip", contenttype: "application/zip") export.expiresat = Decidim.downloadyourdataexpirytime.fromnow export.metadata = {} export.save!

Expect to see an error in the situation.

Now, login as user with ID 1, go to /downloadyourdata, click "Download file" from the export and expect to see the data that should be attached to user with ID 2. This is an artificially replicated situation with the predefined UUIDs but it can easily happen in real situations.

The reason for the test case failure can be replicated in case you change the export ID to export.id = "e9540f96-9e3d-4abe-8c2a-6c338d85a684". This would return 0 through .tos

After attaching that ID, you can test if the file is available for the export:

ruby user.privateexports.last.file.attached? => false user.privateexports.last.file.blob => nil

Note that this fails with such UUID as shown in the example and could easily lead to collisions in case the UUID starts with a number. E.g. UUID "0210ae70-482b-4671-b758-35e13e0097a9" would convert to 210 through .tos. Therefore, if someone else has a "private" export with the prefixes "00000210", "0000210", "000210", "00210", "0210" or "210", that would cause a collision and the file could be attached to the wrong private export.

Theoretical chance of collision (the reality depends on the UUID generation algorithm):

- Potential combinations of the UUID first part (8 characters hex): 16^8 - Potentially colliding character combinations (8 numbers characters in the range of 0-9): 10^8 - 10^8 / 16^8 ≈ 2.3% (23 / 1000 users)

The root cause is that the class Decidim::PrivateExport defines an ActiveStorage relation to file and the table activestorageattachments stores the related recordid as bigint which causes the conversion to happen.

Workarounds Fully disable the private exports feature until a patch is available.