Decidim vulnerabilities
We track 9 vulnerabilities in Decidim products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2026.
Latest Decidim vulnerabilities
- 8.5 High severity
decidim: Authorization Bypass Through User-Controlled Key
Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against anothe
- 7.5 High severity
decidim: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs,
- 7.5 High severity
decidim: Missing Authorization
Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the API allows access to all commentable resources within the platform, without any permission checks. All
- 8.7 High severity
decidim: Improper Neutralization of Input During Web Page Generation
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passi
- 7.1 High severity
decidim: Improper Neutralization of Input During Web Page Generation
Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8.
- 7.1 High severity
decidim: Improper Neutralization of Input During Web Page Generation
Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1.
- 7.4 High severity
decidim: Operation on a Resource after Expiration or Release
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functiona
- 7.1 High severity
decidim: Incorrect Permission Assignment for Critical Resource
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in us
- 7.5 High severity
decidim: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collectio