Vulnerabilities

TI-2026-32253 CVE-2026-44282 · GHSA-9mvp-w4rr-5c6x

Election question titles allow stored script execution

LOW 22

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00391 Published 2026-09-15 Fixed in 0.32.0 CWE-79

TI-2026-33169 CVE-2026-45378 · GHSA-3mvf-82qp-8qh5

Decidim: Verification documents can be downloaded through reusable links

HIGH 72

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00416 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-200

TI-2026-33322 CVE-2026-45573 · GHSA-2g9c-vf8h-prxx

Decidim: Push subscriptions can be abused for server-side requests

LOW 28

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0026 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-918

TI-2026-33321 CVE-2026-45572 · GHSA-533c-2vh9-4r86

Decidim: HTML content blocks allow stored script execution

LOW 22

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00251 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-94

TI-2026-33204 CVE-2026-45415 · GHSA-q79h-67vx-m9xg

Decidim: CSV census record endpoints improper authorization

MEDIUM 60

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00425 Published 2026-08-06 Fixed in 0.30.9, 0.31.5 +1 CWE-862

TI-2026-33203 CVE-2026-45414 · GHSA-r3v7-5x4c-c69q

Decidim: JWT-backed authentication can be replayed across organizations

HIGH 70

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00454 Published 2026-08-06 Fixed in 0.31.5, 0.32.0.rc2 +1 CWE-639

TI-2026-33168 CVE-2026-45377 · GHSA-767h-63j4-5226

Decidim: Private exports can be downloaded through reusable links

MEDIUM 62

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00453 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +1 CWE-200

TI-2026-33167 CVE-2026-45376 · GHSA-jvqq-cvh4-xm37

Decidim: Admin user search allows SQL injection through similarity-based sorting

MEDIUM 58

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00601 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +1 CWE-89

TI-2026-33127 CVE-2026-45330 · GHSA-86fh-w43w-338c

Decidim: Veriﬁcation admins can access supplied IDs from other organisations

MEDIUM 56

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00459 Published 2026-07-31 Fixed in 0.30.9, 0.31.5 +2 CWE-639

TI-2026-32933 CVE-2026-45086 · GHSA-vq6j-hj8w-7v39

Decidim: Forms admin question editor lacks authorization

MEDIUM 58

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00294 Published 2026-07-31 Fixed in 0.31.5, 0.32.0.rc2 +1 CWE-862

TI-2026-29525 CVE-2026-40869 · GHSA-w5xj-99cg-rccm

Decidim amendments can be accepted or rejected by anyone

LOW 38

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00223 Published 2026-04-21 Fixed in 0.31.1, 0.30.5 CWE-266

TI-2026-29526 CVE-2026-40870

Decidim's comments API allows access to all commentable resources

LOW 39

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00287 Published 2026-04-21 Fixed in 0.30.5 CWE-862

TI-2026-19249 CVE-2026-23891 · GHSA-fc46-r95f-hq7g

Decidim has a Cross-site scripting (XSS) vulnerability via user name field

MEDIUM 40

Decidim is a participatory democracy framework.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00356 Published 2026-04-13 Fixed in 0.31.1, 0.30.5 CWE-79

TI-2025-40203 CVE-2025-65017 · GHSA-3cx6-j9j4-54mp

Decidim's private data exports can lead to data leaks

HIGH 71

Decidim is a participatory democracy framework.

CVSS 4.0HIGH 8.2 Network Low privileges User interaction EPSS 0.00313 Published 2026-02-03 Fixed in 0.30.4, 0.31.0 CWE-200

TI-2024-30615 CVE-2024-45594 · GHSA-j4h6-gcj7-7v9v

Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds

LOW 35

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00264 Published 2024-11-13 Fixed in 0.28.3 CWE-79

TI-2024-27734 CVE-2024-41673 · GHSA-cc4g-m3g7-xmw8

Decidim has a cross-site scripting vulnerability in the version control page

LOW 32

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00424 Published 2024-10-01 Fixed in 0.27.8 CWE-79

TI-2024-26804 CVE-2024-39910 · GHSA-vvqw-fqwx-mqmm

Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor

LOW 24

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations.

CVSS 3.1MEDIUM 5.4 Network High privileges User interaction EPSS 0.00275 Published 2024-09-16 Fixed in 0.27.7 CWE-79

TI-2024-21125 CVE-2024-32034 · GHSA-rx9f-5ggv-5rh6

Cross-site scripting (XSS) in the decidim admin activity log

LOW 30

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00374 Published 2024-09-16 Fixed in 0.27.7, 0.28.2 CWE-79

TI-2024-21364 CVE-2024-32469 · GHSA-7cx8-44pc-xv3q

Decidim has cross-site scripting (XSS) in the pagination

LOW 31

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00417 Published 2024-07-10 Fixed in 0.27.6, 0.28.1 CWE-79

TI-2024-17956 CVE-2024-27095 · GHSA-529p-jj47-w3m3

Decidim cross-site scripting (XSS) in the admin panel

LOW 24

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.4 Network High privileges User interaction EPSS 0.00341 Published 2024-07-10 Fixed in 0.27.6, 0.28.1 CWE-79

TI-2024-17951 CVE-2024-27090 · GHSA-qcj6-vxwx-4rqv

Decidim vulnerable to data disclosure through the embed feature

LOW 31

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00492 Published 2024-07-10 Fixed in 0.27.6 CWE-200

TI-2023-28101 CVE-2023-51447 · GHSA-9w99-78rj-hmxq

Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads

LOW 31

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00493 Published 2024-02-20 Fixed in 0.27.5 CWE-79

TI-2023-26084 CVE-2023-48220 · GHSA-w3q8-m492-4pwp

Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

LOW 36

Decidim is a participatory democracy framework.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00791 Published 2024-02-20 Fixed in 0.26.9, 0.27.5 +1 CWE-672

TI-2023-25776 CVE-2023-47635 · GHSA-f3qm-vfc3-jg6v

Decidim vulnerable to possible CSRF attack at questionnaire templates preview

LOW 25

Decidim is a participatory democracy framework.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00313 Published 2024-02-20 Fixed in 0.27.5 CWE-918

TI-2023-25775 CVE-2023-47634 · GHSA-r275-j57c-7mf2

Decidim has race condition in Endorsements

LOW 16

Decidim is a participatory democracy framework.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00444 Published 2024-02-20 Fixed in 0.26.9, 0.27.5 CWE-362

Vulnerabilities

Filters