decidim

The participatory democracy framework. A generator and multiple gems made with Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 178
Cadence: ~2 days
Last 12 months: 23

Reach

Stars: 1.8k

Details

License: unknown
First release: Sep 16, 2016

Releases

Version	Released
`0.32.1` patch	Jul 30, 2026
`0.31.7` patch	Jul 30, 2026
`0.31.6` patch	Jul 06, 2026
`0.32.0` minor	Jul 02, 2026
`0.32.0.rc3` pre 1 CVE	Jun 02, 2026
`0.32.0.rc2` pre 1 CVE	May 12, 2026
`0.31.5` patch	May 12, 2026
`0.30.9` patch 1 CVE	May 12, 2026
`0.32.0.rc1` pre 1 CVE	Apr 24, 2026
`0.31.4` patch 1 CVE	Apr 24, 2026
`0.30.8` patch 1 CVE	Apr 24, 2026
`0.30.7` patch 1 CVE	Mar 26, 2026
`0.31.3` patch 1 CVE	Mar 26, 2026
`0.30.6` patch 1 CVE	Feb 26, 2026
`0.31.2` patch 1 CVE	Feb 26, 2026
`0.30.5` patch 1 CVE	Jan 28, 2026
`0.31.1` patch 1 CVE	Jan 28, 2026
`0.30.4` patch 1 CVE	Nov 20, 2025
`0.29.7` patch 1 CVE	Nov 20, 2025
`0.31.0` minor 1 CVE	Nov 20, 2025
`0.29.6` patch 1 CVE	Oct 28, 2025
`0.30.3` patch 2 CVEs	Oct 28, 2025
`0.31.0.rc2` pre 1 CVE	Oct 28, 2025
`0.31.0.rc1` pre 1 CVE	Sep 25, 2025
`0.30.2` patch 2 CVEs	Sep 23, 2025
`0.29.5` patch 1 CVE	Sep 23, 2025
`0.30.1` patch 2 CVEs	Jun 17, 2025
`0.29.4` patch 1 CVE	Jun 04, 2025
`0.29.3` patch 1 CVE	Apr 29, 2025
`0.28.6` patch 1 CVE	Apr 29, 2025
`0.30.0` minor 2 CVEs	Apr 29, 2025
`0.27.10` patch 1 CVE	Mar 20, 2025
`0.30.0.rc3` pre 1 CVE	Mar 19, 2025
`0.30.0.rc2` pre 1 CVE	Mar 03, 2025
`0.30.0.rc1` pre 1 CVE	Feb 18, 2025
`0.29.2` patch 1 CVE	Feb 12, 2025
`0.28.5` patch 1 CVE	Feb 12, 2025
`0.28.4` patch 1 CVE	Oct 02, 2024
`0.29.1` patch 1 CVE	Oct 02, 2024
`0.28.3` patch 1 CVE	Sep 10, 2024
`0.29.0` minor 1 CVE	Sep 10, 2024
`0.27.9` patch 1 CVE	Sep 10, 2024
`0.29.0.rc4` pre 1 CVE	Jul 30, 2024
`0.27.8` patch 1 CVE	Jul 30, 2024
`0.29.0.rc3` pre 1 CVE	Jul 22, 2024
`0.29.0.rc1` pre 1 CVE	Jul 16, 2024
`0.28.2` patch 1 CVE	Jul 16, 2024
`0.29.0.rc2` pre 1 CVE	Jul 16, 2024
`0.27.7` patch 2 CVEs	Jul 16, 2024
`0.28.1` patch 1 CVE	Apr 30, 2024

1–50 of 178

Repository

decidim/decidim

Forks: 475
Open issues: 319
Language: Ruby
: 7.2/ 10

decidim
democracy
community
government
civic-tech
civictech

Dependencies (21)

Depends on

0.32.1

Used by

Supply-chain exposure

10 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (13)

CVE-2026-45414 GHSA-r3v7-5x4c-c69q Jul 13, 2026

Decidim: JWT-backed authentication can be replayed across organizations

8.5 / 10
High
Network Low Low None Changed High Low None

Description

A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that JWT to the Org 2 API to read Org 2 participant personal data and reach Org 2's proposal.answer mutation path.

Technical description

The current host selects the Decidim organization context, but JWT-backed API authentication is not sufficiently bound to that host organization. As a result, the API can process a request in Org 2's context while still trusting an authenticated principal from Org 1.

Reproduction steps:

Use an API key provided by the system administrator that is assigned to organization 1 to create the JWT token or get the JWT token shown in the response when logged in as the organization admin.

When using this JWT token it is possible to retrieve details from other organisations. Notice the change of the host header in the request below to that of another tenant org2.localhost:3001

Note that using a participant-generated JWT did not allow showing these results.

Impact

A JWT issued for one organization can be replayed successfully against another organization's API and used to retrieve sensitive details from that organization.

Patches

See https://github.com/decidim/decidim/pull/16673 and https://github.com/decidim/decidim/pull/16756

Workarounds

Disable JWT credentials on system panel (/system)

References

OWASP A01:2021 Broken Access Control

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions

0.0.10.0.1.alpha10.0.1.alpha20.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.3

+ 161 more Show less

0.0.40.0.50.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.100.26.20.26.30.26.40.26.50.26.70.26.80.26.90.27.00.27.0.rc10.27.0.rc20.27.10.27.100.27.20.27.30.27.40.27.50.27.60.27.70.27.80.27.90.28.00.28.0.rc40.28.0.rc50.28.10.28.20.28.30.28.40.28.50.28.60.29.00.29.0.rc10.29.0.rc20.29.0.rc30.29.0.rc40.29.10.29.20.29.30.29.40.29.50.29.60.29.70.3.00.3.10.3.20.30.00.30.0.rc10.30.0.rc20.30.0.rc30.30.10.30.20.30.30.30.40.30.50.30.60.30.70.30.80.30.90.31.00.31.0.rc10.31.0.rc20.31.10.31.20.31.30.31.40.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.30.32.0.rc10.32.0.rc20.32.0.rc3

Fixed in

0.31.50.32.0

References

https://github.com/decidim/decidim/security/advisories/GHSA-r3v7-5x4c-c69q
https://github.com/decidim/decidim/pull/16673
https://github.com/decidim/decidim/pull/16756
https://github.com/decidim/decidim

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-65017 GHSA-3cx6-j9j4-54mp Feb 03, 2026

Decidim's private data exports can lead to data leaks

High
Network Low Low

Impact

Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs.

The bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23).

This issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug:

$ cd decidim-core $ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/download_your_data_export_job_spec.rb -e "deletes the" || break ; done

Run the spec as many times as needed to hit a UUID that converts to 0 through .to_i.

The UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example.

The following code regenerates the issue by assigning a predefined UUID that will generate a collision (example assumes there are already two existing users in the system):

# Create the ZIP buffers to be stored buffer1 = Zip::OutputStream.write_buffer do |out| out.put_next_entry("admin.txt") out.write "Hello, admin!" end buffer1.rewind buffer2 = Zip::OutputStream.write_buffer do |out| out.put_next_entry("user.txt") out.write "Hello, user!" end buffer2.rewind # Create the private exports with a predefined IDs user1 = Decidim::User.find(1) export = user1.private_exports.build export.id = "0210ae70-482b-4671-b758-35e13e0097a9" export.export_type = "download_your_data" export.file.attach(io: buffer1, filename: "foobar.zip", content_type: "application/zip") export.expires_at = Decidim.download_your_data_expiry_time.from_now export.metadata = {} export.save! user2 = Decidim::User.find(2) export = user2.private_exports.build export.id = "0210d2df-a0c7-40aa-ad97-2dae5083e3b8" export.export_type = "download_your_data" export.file.attach(io: buffer2, filename: "foobar.zip", content_type: "application/zip") export.expires_at = Decidim.download_your_data_expiry_time.from_now export.metadata = {} export.save!

Expect to see an error in the situation.

Now, login as user with ID 1, go to /download_your_data, click "Download file" from the export and expect to see the data that should be attached to user with ID 2. This is an artificially replicated situation with the predefined UUIDs but it can easily happen in real situations.

The reason for the test case failure can be replicated in case you change the export ID to export.id = "e9540f96-9e3d-4abe-8c2a-6c338d85a684". This would return 0 through .to_s

After attaching that ID, you can test if the file is available for the export:

user.private_exports.last.file.attached? => false user.private_exports.last.file.blob => nil

Note that this fails with such UUID as shown in the example and could easily lead to collisions in case the UUID starts with a number. E.g. UUID "0210ae70-482b-4671-b758-35e13e0097a9" would convert to 210 through .to_s. Therefore, if someone else has a "private" export with the prefixes "00000210", "0000210", "000210", "00210", "0210" or "210", that would cause a collision and the file could be attached to the wrong private export.

Theoretical chance of collision (the reality depends on the UUID generation algorithm):

Potential combinations of the UUID first part (8 characters hex): 16^8

Potentially colliding character combinations (8 numbers characters in the range of 0-9): 10^8

10^8 / 16^8 ≈ 2.3% (23 / 1000 users)

The root cause is that the class Decidim::PrivateExport defines an ActiveStorage relation to file and the table active_storage_attachments stores the related record_id as bigint which causes the conversion to happen.

Workarounds

Fully disable the private exports feature until a patch is available.

Affected versions

0.30.00.30.10.30.20.30.3

Fixed in

0.30.4

References

https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
https://nvd.nist.gov/vuln/detail/CVE-2025-65017
https://github.com/decidim/decidim/pull/13571
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.30.4
https://github.com/decidim/decidim/releases/tag/v0.31.0

Updated Feb 08, 2026 · Source: OSV.dev
CVE-2024-41673 GHSA-cc4g-m3g7-xmw8 Oct 01, 2024

Decidim has a cross-site scripting vulnerability in the version control page

High
Network Low None

Impact

The version control feature used in resources is subject to potential cross-site scripting (XSS) attack through a malformed URL.

Workarounds

Not available

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in a security audit organized by Open Source Politics against Decidim done during July 2025.

Affected versions

0.0.10.0.1.alpha10.0.1.alpha20.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.3

+ 114 more Show less

0.0.40.0.50.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.100.26.20.26.30.26.40.26.50.26.70.26.80.26.90.27.00.27.0.rc10.27.0.rc20.27.10.27.20.27.30.27.40.27.50.27.60.27.70.3.00.3.10.3.20.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.3

Fixed in

0.27.8

References

https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
https://nvd.nist.gov/vuln/detail/CVE-2024-41673
https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637
https://github.com/decidim/decidim
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml

Updated Oct 03, 2024 · Source: OSV.dev
CVE-2024-39910 GHSA-vvqw-fqwx-mqmm Sep 16, 2024

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Medium
Network Low High

Impact

The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server.

The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves.

Patches

N/A

Workarounds

Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it.

Disable the "Enable rich text editor for participants" setting in the admin dashboard

References

OWASP ASVS v4.0.3-5.1.3

Affected versions

0.0.10.0.1.alpha10.0.1.alpha20.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.3

+ 113 more Show less

0.0.40.0.50.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.100.26.20.26.30.26.40.26.50.26.70.26.80.26.90.27.00.27.0.rc10.27.0.rc20.27.10.27.20.27.30.27.40.27.50.27.60.3.00.3.10.3.20.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.3

Fixed in

0.27.7

References

https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm
https://nvd.nist.gov/vuln/detail/CVE-2024-39910
https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f
https://github.com/decidim/decidim
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39910.yml

Updated Sep 17, 2024 · Source: OSV.dev
CVE-2024-32469 GHSA-7cx8-44pc-xv3q Jul 10, 2024

Decidim cross-site scripting (XSS) in the pagination

Medium
Network Low None

Impact

The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter per_page.

Patches

Not available

Workarounds

Not available

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in a security audit organized by the mitgestalten Partizipationsbüro and funded by netidee against Decidim done during April 2024. The security audit was implemented by AIT Austrian Institute of Technology GmbH,

Affected versions

0.0.10.0.1.alpha10.0.1.alpha20.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.3

+ 115 more Show less

0.0.40.0.50.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.100.26.20.26.30.26.40.26.50.26.70.26.80.26.90.27.00.27.0.rc10.27.0.rc20.27.10.27.20.27.30.27.40.27.50.3.00.3.10.3.20.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.30.28.00.28.0.rc40.28.0.rc5

Fixed in

0.27.60.28.1

References

https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q
https://nvd.nist.gov/vuln/detail/CVE-2024-32469
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.27.6
https://github.com/decidim/decidim/releases/tag/v0.28.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-32469.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-27090 GHSA-qcj6-vxwx-4rqv Jul 10, 2024

Decidim vulnerable to data disclosure through the embed feature

Medium
Network Low None None

Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.

Patches

version 0.27.6

https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705

Workarounds

Disallow access through your web server to the URLs finished with /embed.html

Affected versions

0.0.10.0.1.alpha10.0.1.alpha20.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.3

+ 112 more Show less

0.0.40.0.50.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.100.26.20.26.30.26.40.26.50.26.70.26.80.26.90.27.00.27.0.rc10.27.0.rc20.27.10.27.20.27.30.27.40.27.50.3.00.3.10.3.20.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.3

Fixed in

0.27.6

References

https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
https://nvd.nist.gov/vuln/detail/CVE-2024-27090
https://github.com/decidim/decidim/pull/12528
https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.27.6

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-51447 GHSA-9w99-78rj-hmxq Feb 20, 2024

Cross-site scripting (XSS) in the dynamic file uploads

6.3 / 10
Medium
Network Low Low Required Unchanged High Low None

Impact

The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server.

This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed.

Successful exploit of this vulneratibility would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached.

The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database as shown here: https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14

The attacker is able to change the filename e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.

Therefore, anywhere we display these strings, we should properly escape them.

Patches

PR #11612 fixes this problem both for 0.28.dev and 0.27.x.

Workarounds

Disable dynamic uploads for the instance, e.g. from proposals.

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions

0.27.00.27.10.27.20.27.30.27.4

Fixed in

0.27.5

References

https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq
https://nvd.nist.gov/vuln/detail/CVE-2023-51447
https://github.com/decidim/decidim/pull/11612
https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.27.5

Updated Feb 20, 2024 · Source: OSV.dev
CVE-2023-48220 GHSA-w3q8-m492-4pwp Feb 20, 2024

Possibility to circumvent the invitation token expiry period

5.7 / 10
Medium
Network High High Required Unchanged High High None

Impact

The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.

When using the password reset functionality, the devise_invitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the devise_invitable gem: https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198

The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invite_for expiry period as explained in the gem's documentation: https://github.com/scambra/devise_invitable#model-configuration-

invite_for: The period the generated invitation token is valid. After this period, the invited resource won’t be able to accept the invitation. When invite_for is 0 (the default), the invitation won’t expire.

Decidim sets this configuration to 2.weeks so this configuration should be respected: https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134

The bug is in the devise_invitable gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.

Patches

Update devise_invitable to version 2.0.9 or above by running the following command:

$ bundle update devise_invitable

Workarounds

The invitations can be cancelled directly from the database by running the following command from the Rails console:

> Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)

References

OWASP ASVS V4.0.3-2.3.1

This bug has existed in the devise_invitable gem since this commit which was first included in the v0.4.rc3 release of this gem: https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098

All versions since then are affected.

This gem was first introduced at its version ~> 1.7.0 to the decidim-admin gem in this commit which was first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34

It was first introduced at its version ~> 1.7.0 to the decidim-system gem in this commit which was also first included in the v0.0.1.alpha3 release of Decidim: https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454

Credits

This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by Deloitte Finland.

Affected versions

0.0.10.0.1.alpha30.0.1.alpha40.0.1.alpha50.0.1.alpha60.0.1.alpha70.0.1.alpha80.0.1.alpha90.0.20.0.30.0.40.0.5

+ 105 more Show less

0.0.60.0.70.0.8.10.1.00.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.10.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.2.00.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.20.26.30.26.40.26.50.26.70.26.80.3.00.3.10.3.20.4.00.4.10.4.20.4.30.4.40.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.30.27.00.27.10.27.20.27.30.27.4

Fixed in

0.26.90.27.5

References

https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
https://nvd.nist.gov/vuln/detail/CVE-2023-48220
https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
https://github.com/decidim/decidim

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-47634 GHSA-r275-j57c-7mf2 Feb 20, 2024

Race condition in Endorsements

3.1 / 10
Low
Network High Low None Unchanged None Low None

Impact

A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement.

To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel.

Workarounds

Disable the Endorsement feature in the components.

Affected versions

0.10.00.10.10.11.0.pre10.11.10.11.20.12.00.12.0.pre0.12.10.12.20.13.00.13.0.pre10.13.1

+ 55 more Show less

0.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.19.00.19.10.20.00.20.10.21.00.22.00.23.00.23.10.23.1.rc10.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.20.26.30.26.40.26.50.26.70.26.80.27.00.27.10.27.20.27.30.27.4

Fixed in

0.26.90.27.5

References

https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2
https://nvd.nist.gov/vuln/detail/CVE-2023-47634
https://github.com/decidim/decidim/commit/5c5ee7a50d75c10643dd8c495e2517641e4d74db
https://github.com/decidim/decidim/commit/7b840d2c37a562709f4481db644d8c43add28536
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.26.9

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-36465 GHSA-639h-86hw-qcjq Oct 05, 2023

Decidim has broken access control in templates

7.1 / 10
High
Network Low Low None Unchanged None High Low

Impact

The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.

Affected versions

0.23.20.23.30.23.40.23.50.23.60.24.00.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.0

+ 18 more Show less

0.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.20.26.30.26.40.26.50.26.70.27.00.27.10.27.20.27.3

Fixed in

0.26.80.27.4

References

https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
https://nvd.nist.gov/vuln/detail/CVE-2023-36465
https://github.com/decidim/decidim
https://github.com/decidim/decidim/releases/tag/v0.26.8
https://github.com/decidim/decidim/releases/tag/v0.27.4
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml

Updated Sep 10, 2026 · Source: OSV.dev

1–10 of 13

Insights

Releases per month

last 12 months

Release mix

minor 32
patch 109
pre 36

178 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More