{"cve":"CVE-2026-40869","nvd":{"published":"2026-04-21T20:17:00.207","modified":"2026-06-17T10:45:47.800","status":"Analyzed","description":"Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-266"],"references":["https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9","https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm"],"products":["decidim:decidim"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-40869","score":0.00223,"percentile":0.12934,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w5xj-99cg-rccm","url":"https://osv.dev/vulnerability/GHSA-w5xj-99cg-rccm","summary":"Decidim amendments can be accepted or rejected by anyone","modified":"2026-05-29T22:00:13.460694346Z","packages":[{"ecosystem":"RubyGems","name":"decidim-core","purl":"pkg:gem/decidim-core","ranges":[">=0.31.0.rc1 <0.31.1"],"fixed":["0.31.1"]},{"ecosystem":"RubyGems","name":"decidim-core","purl":"pkg:gem/decidim-core","ranges":[">=0.19.0 <0.30.5"],"fixed":["0.30.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}