CVE-2026-40870
Unauthorized Access via Unchecked API Commentable Field in Decidim
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| decidim | decidim | From 0.31.1 (exc) |
| decidim | decidim | 0.19.0 |
| decidim | decidim | 0.22.0 |
| decidim | decidim | 0.30.5 |
| decidim | decidim | 0.31.1 |
| decidim | decidim | From 0.0.1 (inc) to 0.30.5 (exc) |
| decidim | decidim | From 0.31.1 (inc) |
| decidim | decidim | From 0.19.0 (inc) |
| decidim | decidim | From 0.22.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized access to all commentable resources on Decidim instances with unsecured `/api` endpoints, resulting in a high confidentiality breach.
If the platform protects private participation spaces or sensitive data, this exposure could lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require strict controls on unauthorized data access.
For platforms primarily serving public data, the risk and impact on compliance are lower.
Mitigations include restricting API access to authenticated users or trusted IP ranges, which can help reduce the risk of unauthorized data exposure and support compliance efforts.
Can you explain this vulnerability to me?
CVE-2026-40870 is a high-severity vulnerability in the Decidim platform's API, specifically related to the root-level `commentable` field. This field allows access to all commentable resources on the platform without any permission checks.
Because the `/api` endpoint is publicly accessible by default, any user, including unauthenticated ones, can retrieve data from all commentable resources if the endpoint is not secured.
The vulnerability affects all Decidim versions greater than 0.0.1 and prior to versions 0.30.5 and 0.31.1, which contain the fixes.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to all commentable resources on a Decidim instance with an unsecured `/api` endpoint.
No privileges or user interaction are required to exploit this vulnerability, making it easy for attackers to retrieve sensitive data.
While it does not affect data integrity or availability, it results in a high confidentiality breach by exposing potentially sensitive information.
The severity of the impact depends on the nature of the platform: if it primarily serves public data, the risk is lower; if it protects private participation spaces or sensitive data, the risk is significant.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Decidim platform's `/api` endpoint is publicly accessible without authentication and if it exposes the root-level `commentable` field allowing access to all commentable resources without permission checks.
You can test this by sending an unauthenticated HTTP request to the `/api` endpoint and observing if commentable resources are returned.
- Use curl to send a request to the API endpoint: curl -i http://your-decidim-instance/api
- Check the response for the presence of commentable resources data without authentication.
- Alternatively, use tools like curl or wget to verify if the API endpoint requires authentication or returns data publicly.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the `/api` endpoint to authenticated users only.
This can be done by implementing custom code or installing the third-party module `Decidim::Apiauth`.
- Add custom code to limit API access to authenticated users, for example by using a Rails initializer that checks user authentication before allowing access.
- Restrict access to the `/api` endpoint by IP address using web server configuration such as Nginx, allowing only trusted IPs.
- Consider disabling public access to the `/api` endpoint entirely if the platform does not require public API access.
Also, enabling the organization setting "Force users to authenticate before access organization" limits the vulnerability's scope to authenticated users only.
Finally, upgrade Decidim to patched versions 0.30.5 or 0.31.1 as soon as possible to fully fix the issue.