CVE-2026-40869 Decidim amendments can be accepted or rejected by anyone
Authenticated users can accept or reject any amendments, potentially gaining co-authorship privileges on proposals in Decidim.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40869?
CVE-2026-40869 is a high-severity missing authorization vulnerability in decidim, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).
Weakness: CWE-266
Which versions are affected by CVE-2026-40869?
4 open source packages ship an affected version, including decidim-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
decidim-core RubyGems | From 0.19.0 | 0.30.5 |
decidim-core RubyGems | From 0.19.0 | 0.30.5 |
decidim-core RubyGems | From 0.31.0.rc1 | 0.31.1 |
decidim-core RubyGems | From 0.31.0.rc1 | 0.31.1 |
Products include Decidim Decidim.
How do I fix CVE-2026-40869?
Upgrade decidim-core to a fixed version for your release line: 0.30.5 or 0.31.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40869 being exploited?
There is no known exploitation of CVE-2026-40869 in the wild and no public exploit code.
Other vulnerabilities in decidim
- CVE-2026-23891 Decidim has a Cross-site scripting (XSS) vulnerability via user name field
- CVE-2023-36465 Decidim has broken access control in templates
- CVE-2025-65017 Decidim's private data exports can lead to data leaks
- CVE-2023-32693 Decidim Cross-site Scripting vulnerability in the external link redirections
- CVE-2023-34089 Decidim Cross-site Scripting vulnerability in the processes filter
Sources
Also known as GHSA-w5xj-99cg-rccm.