Decidim vulnerabilities
29 CVEs and advisories name Decidim as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-44282Election question titles allow stored script execution
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable links
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requests
- CVE-2026-45572Decidim: HTML content blocks allow stored script execution
- CVE-2026-45415Decidim: CSV census record endpoints improper authorization
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizations
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable links
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sorting
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisations
- CVE-2026-45086Decidim: Forms admin question editor lacks authorization
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyone
- CVE-2026-40870Decidim's comments API allows access to all commentable resources
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name field
- CVE-2025-65017Decidim's private data exports can lead to data leaks
- CVE-2024-45594Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds
- CVE-2024-41673Decidim has a cross-site scripting vulnerability in the version control page
- CVE-2024-39910Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
- CVE-2024-32034Cross-site scripting (XSS) in the decidim admin activity log
- CVE-2024-32469Decidim has cross-site scripting (XSS) in the pagination
- CVE-2024-27095Decidim cross-site scripting (XSS) in the admin panel
- CVE-2024-27090Decidim vulnerable to data disclosure through the embed feature
- CVE-2023-51447Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
- CVE-2023-48220Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
- CVE-2023-47635Decidim vulnerable to possible CSRF attack at questionnaire templates preview
- CVE-2023-47634Decidim has race condition in Endorsements
- CVE-2023-36465Decidim has broken access control in templates
- CVE-2023-34089Decidim Cross-site Scripting vulnerability in the processes filter
- CVE-2023-34090Decidim vulnerable to sensitive data disclosure
- CVE-2023-32693Decidim Cross-site Scripting vulnerability in the external link redirections