Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
Priority LOW 36CWE-672Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00791 56th percentileScored 2026-11-07
Fix Fixed decidim (decidim): 0.26.9, 0.27.5, 2.0.9decidim (RubyGems): 0.26.9, 0.27.5+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| decidim | decidim | 0.0.1.alpha3 to before 0.26.9; 0.27.0 to before 0.27.5; 0.4.rc3 to before 2.0.9 | 0.26.9, 0.27.5, 2.0.9 | Patch available | CNA |
| — | decidim (RubyGems) | 0.0.1.alpha3 to before 0.26.9 | 0.26.9 | Patch available | GHSA-w3q8-m492-4pwp |
| — | decidim-admin (RubyGems) | 0.0.1.alpha3 to before 0.26.9 | 0.26.9 | Patch available | GHSA-w3q8-m492-4pwp |
| — | decidim-system (RubyGems) | 0.0.1.alpha3 to before 0.26.9 | 0.26.9 | Patch available | GHSA-w3q8-m492-4pwp |
| — | devise_invitable (RubyGems) | 0.4.rc3 to before 2.0.9 | 2.0.9 | Patch available | GHSA-w3q8-m492-4pwp |
| — | decidim (RubyGems) | 0.27.0 to before 0.27.5 | 0.27.5 | Patch available | GHSA-w3q8-m492-4pwp |
| — | decidim-admin (RubyGems) | 0.27.0 to before 0.27.5 | 0.27.5 | Patch available | GHSA-w3q8-m492-4pwp |
| — | decidim-system (RubyGems) | 0.27.0 to before 0.27.5 | 0.27.5 | Patch available | GHSA-w3q8-m492-4pwp |
- decidim Vendordecidim Affected 0.0.1.alpha3 to before 0.26.9; 0.27.0 to before 0.27.5; 0.4.rc3 to before 2.0.9 Fixed in 0.26.9, 0.27.5, 2.0.9 Patch available CNA
- decidim (RubyGems) Vendor— Affected 0.0.1.alpha3 to before 0.26.9 Fixed in 0.26.9 Patch available GHSA-w3q8-m492-4pwp
- decidim-admin (RubyGems) Vendor— Affected 0.0.1.alpha3 to before 0.26.9 Fixed in 0.26.9 Patch available GHSA-w3q8-m492-4pwp
- decidim-system (RubyGems) Vendor— Affected 0.0.1.alpha3 to before 0.26.9 Fixed in 0.26.9 Patch available GHSA-w3q8-m492-4pwp
- devise_invitable (RubyGems) Vendor— Affected 0.4.rc3 to before 2.0.9 Fixed in 2.0.9 Patch available GHSA-w3q8-m492-4pwp
- decidim (RubyGems) Vendor— Affected 0.27.0 to before 0.27.5 Fixed in 0.27.5 Patch available GHSA-w3q8-m492-4pwp
- decidim-admin (RubyGems) Vendor— Affected 0.27.0 to before 0.27.5 Fixed in 0.27.5 Patch available GHSA-w3q8-m492-4pwp
- decidim-system (RubyGems) Vendor— Affected 0.27.0 to before 0.27.5 Fixed in 0.27.5 Patch available GHSA-w3q8-m492-4pwp
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* | 0.0.2 to before 0.26.9; 0.27.0 to before 0.27.5 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:-:*:*:*:ruby:*:* | 0.0.1 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha3:*:*:*:ruby:*:* | 0.0.1 alpha3 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha4:*:*:*:ruby:*:* | 0.0.1 alpha4 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha5:*:*:*:ruby:*:* | 0.0.1 alpha5 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha6:*:*:*:ruby:*:* | 0.0.1 alpha6 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha7:*:*:*:ruby:*:* | 0.0.1 alpha7 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha8:*:*:*:ruby:*:* | 0.0.1 alpha8 | Vulnerable | decidim |
| cpe:2.3:a:decidim:decidim:0.0.1:alpha9:*:*:*:ruby:*:* | 0.0.1 alpha9 | Vulnerable | decidim |
| cpe:2.3:a:scambra:devise_invitable:*:*:*:*:*:ruby:*:* | 0.4.1 to before 2.0.9 | Vulnerable | Scambra |
- cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* Versions 0.0.2 to before 0.26.9; 0.27.0 to before 0.27.5 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:-:*:*:*:ruby:*:* Versions 0.0.1 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha3:*:*:*:ruby:*:* Versions 0.0.1 alpha3 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha4:*:*:*:ruby:*:* Versions 0.0.1 alpha4 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha5:*:*:*:ruby:*:* Versions 0.0.1 alpha5 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha6:*:*:*:ruby:*:* Versions 0.0.1 alpha6 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha7:*:*:*:ruby:*:* Versions 0.0.1 alpha7 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha8:*:*:*:ruby:*:* Versions 0.0.1 alpha8 Vulnerable ·decidim
- cpe:2.3:a:decidim:decidim:0.0.1:alpha9:*:*:*:ruby:*:* Versions 0.0.1 alpha9 Vulnerable ·decidim
- cpe:2.3:a:scambra:devise_invitable:*:*:*:*:*:ruby:*:* Versions 0.4.1 to before 2.0.9 Vulnerable ·Scambra
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:scambra:devise_invitable:0.4.0:-:*:*:*:ruby:*:* | 0.4.0 | Vulnerable | Scambra |
| cpe:2.3:a:scambra:devise_invitable:0.4.0:rc3:*:*:*:ruby:*:* | 0.4.0 rc3 | Vulnerable | Scambra |
| cpe:2.3:a:scambra:devise_invitable:0.4.0:rc4:*:*:*:ruby:*:* | 0.4.0 rc4 | Vulnerable | Scambra |
| cpe:2.3:a:scambra:devise_invitable:0.4.0:rc5:*:*:*:ruby:*:* | 0.4.0 rc5 | Vulnerable | Scambra |
- cpe:2.3:a:scambra:devise_invitable:0.4.0:-:*:*:*:ruby:*:* Versions 0.4.0 Vulnerable ·Scambra
- cpe:2.3:a:scambra:devise_invitable:0.4.0:rc3:*:*:*:ruby:*:* Versions 0.4.0 rc3 Vulnerable ·Scambra
- cpe:2.3:a:scambra:devise_invitable:0.4.0:rc4:*:*:*:ruby:*:* Versions 0.4.0 rc4 Vulnerable ·Scambra
- cpe:2.3:a:scambra:devise_invitable:0.4.0:rc5:*:*:*:ruby:*:* Versions 0.4.0 rc5 Vulnerable ·Scambra
Remediation
- Fix · CNA decidim (decidim) Fixed in 0.26.9, 0.27.5, 2.0.9
- Fix · GHSA-w3q8-m492-4pwp decidim (RubyGems) Fixed in 0.26.9 Advisory →
- Fix · GHSA-w3q8-m492-4pwp decidim-admin (RubyGems) Fixed in 0.26.9 Advisory →
- Fix · GHSA-w3q8-m492-4pwp decidim-system (RubyGems) Fixed in 0.26.9 Advisory →
- Fix · GHSA-w3q8-m492-4pwp devise_invitable (RubyGems) Fixed in 2.0.9 Advisory →
- Fix · GHSA-w3q8-m492-4pwp decidim (RubyGems) Fixed in 0.27.5 Advisory →
- Fix · GHSA-w3q8-m492-4pwp decidim-admin (RubyGems) Fixed in 0.27.5 Advisory →
- Fix · GHSA-w3q8-m492-4pwp decidim-system (RubyGems) Fixed in 0.27.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-48220
- 2026-10-03 Alias added: GHSA-w3q8-m492-4pwp
References
Patch 4
- https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
- https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
- https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
- https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
Other 6
- https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134
- https://github.com/decidim/decidim/releases/tag/v0.26.9
- https://github.com/decidim/decidim/releases/tag/v0.27.5
- https://github.com/decidim/decidim/releases/tag/v0.28.0
- https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
- https://github.com/decidim/decidim
More Decidim vulnerabilities
- TI-2025-40203 Decidim's private data exports can lead to data leaks CVSS 4.0HIGH 8.2
- TI-2023-16936 Decidim vulnerable to sensitive data disclosure CVSS 3.1HIGH 7.5
- TI-2026-19249 Decidim has a Cross-site scripting (XSS) vulnerability via user name field CVSS 4.0CRITICAL 9.3
- TI-2023-18306 Decidim has broken access control in templates CVSS 3.1CRITICAL 9.1
- TI-2023-16935 Decidim Cross-site Scripting vulnerability in the processes filter CVSS 3.1HIGH 8.1
- TI-2023-15969 Decidim Cross-site Scripting vulnerability in the external link redirections CVSS 3.1HIGH 8.1
Sources
- CVE-2023-48220 · CVE Program
- CVE-2023-48220 · NVD
- FIRST EPSS
- GHSA-w3q8-m492-4pwp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences