Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-40870 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the API allows access to all commentable resources within the platform, without any permission checks. All Decidim instances are impacted that have not secured the `/api` endpoint. The `/api` endpoint is publicly available with the default configuration. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, limit the scope to only authenticated users by limiting access to the `/api` endpoint. This would require custom code or installing the 3rd party module `Decidim::Apiauth`. With custom code, the `/api` endpoint can be limited to only authenticated users. The same configuration can be also used without the `allow` statements to disable all traffic to the the `/api` endpoint. When considering a workaround and the seriousness of the vulnerability, please consider the nature of the platform. If the platform is primarily serving public data, this vulnerability is not serious by its nature. If the platform is protecting some resources, e.g. inside private participation spaces, the vulnerability may expose some data to the attacker that is not meant public. For those who have enabled the organization setting "Force users to authenticate before access organization", the scope of this vulnerability is limited to the users who are allowed to log in to the Decidim platform. This setting was introduced in version 0.19.0 and it was applied to the `/api` endpoint in version 0.22.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
Decidim	> 0.0.1 (semver)
CPE cpe:2.3:a:decidim:decidim::::::ruby::* Remediation Upgrade: 0.31.1moderate effort Upgrade: 0.30.5moderate effort Workaround:moderate effort Limit access to the "/api" endpoint to only authenticated users. This can be achieved by implementing custom code or installing the third-party module "Decidim::Apiauth". The following code can be used to restrict access to authenticated users: ```ruby # Within your application # config/initializers/limit_api_access.rb module LimitApiAccess extend ActiveSupport::Concern included do prepend_before_action do \|controller\| unless controller.send(:user_signed_in?) render plain: I18n.t("actions.login_before_access", scope: "decidim.core"), status: :unauthorized end end end end Rails.application.config.to_prepare do Decidim::Api::ApplicationController.include(LimitApiAccess) end ``` Workaround:moderate effort Limit the availability of the "/api" endpoint to only trusted IP ranges. The following Nginx configuration can be used to restrict access to specific IPs: ``` location /api { allow 192.168.1.100; allow 192.168.1.101; deny all; } ``` This configuration can also be used without the "allow" statements to completely disable traffic to the "/api" endpoint.

Product

Versions

Decidim

> 0.0.1 (semver)

CPE

cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*

Remediation

Upgrade: 0.31.1moderate effort
Upgrade: 0.30.5moderate effort
Workaround:moderate effort
Limit access to the "/api" endpoint to only authenticated users. This can be achieved by implementing custom code or installing the third-party module "Decidim::Apiauth". The following code can be used to restrict access to authenticated users: ```ruby # Within your application # config/initializers/limit_api_access.rb module LimitApiAccess extend ActiveSupport::Concern included do prepend_before_action do |controller| unless controller.send(:user_signed_in?) render plain: I18n.t("actions.login_before_access", scope: "decidim.core"), status: :unauthorized end end end end Rails.application.config.to_prepare do Decidim::Api::ApplicationController.include(LimitApiAccess) end ```
Workaround:moderate effort
Limit the availability of the "/api" endpoint to only trusted IP ranges. The following Nginx configuration can be used to restrict access to specific IPs: ``` location /api { allow 192.168.1.100; allow 192.168.1.101; deny all; } ``` This configuration can also be used without the "allow" statements to completely disable traffic to the "/api" endpoint.

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 21, 2026	New CVE Received	[email protected]