CVE-2023-47634
Decidim has race condition in Endorsements
CVE-2023-47634 is a low vulnerability (CVSS 3.1) in Decidim, published February 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in decidim 0.26.9.
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Decidim has race condition in Endorsements
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.
- Record
CVE-2023-47634- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2024-0706
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.
- Record
EUVD-2024-0706- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r275-j57c-7mf2
Race condition in Endorsements
Impact
A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement.
To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel.
Workarounds
Disable the Endorsement feature in the components.
- Record
GHSA-r275-j57c-7mf2- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.
- Record
CVE-2023-47634- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
Decidim has race condition in Endorsements
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.
- Record
CVE-2023-47634- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-r275-j57c-7mf2
Race condition in Endorsements
Impact
A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement.
To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel.
Workarounds
Disable the Endorsement feature in the components.
- Record
GHSA-r275-j57c-7mf2- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
decidimRubyGems |
0.10.0 up to 0.26.9 | 0.26.9 |
decidimRubyGems |
0.27.0 up to 0.27.5 | 0.27.5 |
decidimRubyGems |
0.10.0 up to 0.26.9, plus listed versions 0.10.10.11.0.pre10.11.10.11.20.12.0 Show 45 moreShow less0.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc4 |
0.26.9 |
decidimRubyGems |
0.27.0 up to 0.27.5, plus listed versions 0.27.10.27.20.27.30.27.4 |
0.27.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2
Left out here: 11 versions. The JSON record has them.