decidim

Records29All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

decidim records in CISA KEV

No decidim vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Decidim 15 records HIGH

Records

29 records

TI-2026-33169 CVE-2026-45378 · GHSA-3mvf-82qp-8qh5

Decidim: Verification documents can be downloaded through reusable links

HIGH 72

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00416 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-200

TI-2025-40203 CVE-2025-65017 · GHSA-3cx6-j9j4-54mp

Decidim's private data exports can lead to data leaks

HIGH 71

Decidim is a participatory democracy framework.

CVSS 4.0HIGH 8.2 Network Low privileges User interaction EPSS 0.00313 Published 2026-02-03 Fixed in 0.30.4, 0.31.0 CWE-200

TI-2026-33203 CVE-2026-45414 · GHSA-r3v7-5x4c-c69q

Decidim: JWT-backed authentication can be replayed across organizations

HIGH 70

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00454 Published 2026-08-06 Fixed in 0.31.5, 0.32.0.rc2 +1 CWE-639

TI-2026-33168 CVE-2026-45377 · GHSA-767h-63j4-5226

Decidim: Private exports can be downloaded through reusable links

MEDIUM 62

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00453 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +1 CWE-200

TI-2026-33204 CVE-2026-45415 · GHSA-q79h-67vx-m9xg

Decidim: CSV census record endpoints improper authorization

MEDIUM 60

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00425 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-862

TI-2026-33167 CVE-2026-45376 · GHSA-jvqq-cvh4-xm37

Decidim: Admin user search allows SQL injection through similarity-based sorting

MEDIUM 58

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00601 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +1 CWE-89

TI-2026-32933 CVE-2026-45086 · GHSA-vq6j-hj8w-7v39

Decidim: Forms admin question editor lacks authorization

MEDIUM 58

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00294 Published 2026-07-31 Fixed in 0.31.5, 0.32.0.rc2 +1 CWE-862

TI-2026-33127 CVE-2026-45330 · GHSA-86fh-w43w-338c

Decidim: Veriﬁcation admins can access supplied IDs from other organisations

MEDIUM 56

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00459 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +2 CWE-639

TI-2023-16936 CVE-2023-34090 · GHSA-jm79-9pm4-vrw9

Decidim vulnerable to sensitive data disclosure

MEDIUM 41

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0126 Published 2023-07-11 Fixed in 0.27.3 CWE-200

TI-2026-19249 CVE-2026-23891 · GHSA-fc46-r95f-hq7g

Decidim has a Cross-site scripting (XSS) vulnerability via user name field

MEDIUM 40

Decidim is a participatory democracy framework.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00356 Published 2026-04-13 Fixed in 0.31.1, 0.30.5 CWE-79

TI-2023-18306 CVE-2023-36465 · GHSA-639h-86hw-qcjq

Decidim has broken access control in templates

MEDIUM 40

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00674 Published 2023-10-06 Fixed in 0.26.8, 0.27.4 CWE-284

TI-2026-29526 CVE-2026-40870

Decidim's comments API allows access to all commentable resources

LOW 39

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00287 Published 2026-04-21 Fixed in 0.30.5 CWE-862

TI-2023-16935 CVE-2023-34089 · GHSA-5652-92r9-3fx9

Decidim Cross-site Scripting vulnerability in the processes filter

LOW 39

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00736 Published 2023-07-11 Fixed in 0.26.7, 0.27.3 CWE-79

TI-2023-15969 CVE-2023-32693 · GHSA-469h-mqg8-535r

Decidim Cross-site Scripting vulnerability in the external link redirections

LOW 39

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00816 Published 2023-07-11 Fixed in 0.26.7, 0.27.3 CWE-79

TI-2026-29525 CVE-2026-40869 · GHSA-w5xj-99cg-rccm

Decidim amendments can be accepted or rejected by anyone

LOW 38

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00223 Published 2026-04-21 Fixed in 0.31.1, 0.30.5 CWE-266

TI-2023-26084 CVE-2023-48220 · GHSA-w3q8-m492-4pwp

Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

LOW 36

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00791 Published 2024-02-20 Fixed in 0.26.9, 0.27.5 +1 CWE-672

TI-2024-30615 CVE-2024-45594 · GHSA-j4h6-gcj7-7v9v

Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds

LOW 35

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00264 Published 2024-11-13 Fixed in 0.28.3 CWE-79

TI-2024-27734 CVE-2024-41673 · GHSA-cc4g-m3g7-xmw8

Decidim has a cross-site scripting vulnerability in the version control page

LOW 32

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00424 Published 2024-10-01 Fixed in 0.27.8 CWE-79

TI-2024-21364 CVE-2024-32469 · GHSA-7cx8-44pc-xv3q

Decidim has cross-site scripting (XSS) in the pagination

LOW 31

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00417 Published 2024-07-10 Fixed in 0.27.6, 0.28.1 CWE-79

TI-2024-17951 CVE-2024-27090 · GHSA-qcj6-vxwx-4rqv

Decidim vulnerable to data disclosure through the embed feature

LOW 31

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00492 Published 2024-07-10 Fixed in 0.27.6 CWE-200

TI-2023-28101 CVE-2023-51447 · GHSA-9w99-78rj-hmxq

Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads

LOW 31

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00493 Published 2024-02-20 Fixed in 0.27.5 CWE-79

TI-2024-21125 CVE-2024-32034 · GHSA-rx9f-5ggv-5rh6

Cross-site scripting (XSS) in the decidim admin activity log

LOW 30

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00374 Published 2024-09-16 Fixed in 0.27.7, 0.28.2 CWE-79

TI-2026-33322 CVE-2026-45573 · GHSA-2g9c-vf8h-prxx

Decidim: Push subscriptions can be abused for server-side requests

LOW 28

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0026 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-918

TI-2023-25776 CVE-2023-47635 · GHSA-f3qm-vfc3-jg6v

Decidim vulnerable to possible CSRF attack at questionnaire templates preview

LOW 25

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00313 Published 2024-02-20 Fixed in 0.27.5 CWE-918

TI-2024-26804 CVE-2024-39910 · GHSA-vvqw-fqwx-mqmm

Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor

LOW 24

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations.

CVSS 3.1MEDIUM 5.4 Network High privileges User interaction EPSS 0.00275 Published 2024-09-16 Fixed in 0.27.7 CWE-79

Open these records in search →