Decidim vulnerabilities

Products

• Decidim 29

Newest

• decidim Election question titles allow stored script execution CVE-2026-44282 Fix available 4.8 MediumSeptember 9, 2026
• decidim Decidim: Push subscriptions can be abused for server-side requests CVE-2026-45573 Fix available 6.4 MediumJuly 13, 2026
• decidim Decidim: HTML content blocks allow stored script execution CVE-2026-45572 Fix available 4.8 MediumJuly 13, 2026
• decidim Decidim: CSV census record endpoints improper authorization CVE-2026-45415 Fix available 6.0 MediumJuly 13, 2026
• decidim Decidim: JWT-backed authentication can be replayed across organizations CVE-2026-45414 Fix available 8.5 HighJuly 13, 2026
• decidim Decidim: Verification documents can be downloaded through reusable links CVE-2026-45378 Fix available 7.5 HighJuly 13, 2026
• decidim Decidim: Private exports can be downloaded through reusable links CVE-2026-45377 Fix available 6.5 MediumJuly 13, 2026
• decidim Decidim: Admin user search allows SQL injection through similarity-based sorting CVE-2026-45376 Fix available 5.5 MediumJuly 13, 2026
• decidim Decidim: Verification admins can access supplied IDs from other organisations CVE-2026-45330 Fix available 4.9 MediumJuly 13, 2026
• decidim Decidim: Forms admin question editor lacks authorization CVE-2026-45086 Fix available 5.4 MediumJuly 13, 2026
• decidim Decidim's comments API allows access to all commentable resources CVE-2026-40870 Fix available 7.5 HighApril 14, 2026
• decidim Decidim amendments can be accepted or rejected by anyone CVE-2026-40869 Fix available 7.5 HighApril 14, 2026
• decidim Decidim has a Cross-site scripting (XSS) vulnerability via user name field CVE-2026-23891 Fix available 9.3 CriticalApril 13, 2026
• decidim Decidim's private data exports can lead to data leaks CVE-2025-65017 Fix available 8.2 HighFebruary 3, 2026
• decidim Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds CVE-2024-45594 Fix available 7.7 HighNovember 13, 2024
• decidim Decidim has a cross-site scripting vulnerability in the version control page CVE-2024-41673 Fix available 7.1 HighOctober 1, 2024
• decidim Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor CVE-2024-39910 Fix available 5.4 MediumSeptember 16, 2024
• decidim Cross-site scripting (XSS) in the decidim admin activity log CVE-2024-32034 Fix available 6.8 MediumSeptember 16, 2024
• decidim Decidim cross-site scripting (XSS) in the admin panel CVE-2024-27095 Fix available 5.4 MediumJuly 10, 2024
• decidim Decidim has cross-site scripting (XSS) in the pagination CVE-2024-32469 Fix available 7.1 HighJuly 10, 2024
• decidim Decidim vulnerable to data disclosure through the embed feature CVE-2024-27090 Fix available 5.3 MediumJuly 10, 2024
• decidim Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads CVE-2023-51447 Fix available 6.3 MediumFebruary 20, 2024
• decidim, scambra devise invitable +1 more Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period CVE-2023-48220 Fix available 5.7 MediumFebruary 20, 2024
• decidim Decidim vulnerable to possible CSRF attack at questionnaire templates preview CVE-2023-47635 Fix available 4.5 MediumFebruary 20, 2024
• decidim Decidim has race condition in Endorsements CVE-2023-47634 Fix available 3.1 LowFebruary 20, 2024
• decidim Decidim has broken access control in templates CVE-2023-36465 Fix available 9.1 CriticalOctober 5, 2023
• decidim Decidim Cross-site Scripting vulnerability in the processes filter CVE-2023-34089 Fix available 8.1 HighJuly 11, 2023
• decidim Decidim vulnerable to sensitive data disclosure CVE-2023-34090 Fix available 7.5 HighJuly 11, 2023
• decidim Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-32693 Fix available 8.1 HighJuly 11, 2023