Decidim API Flaw Exposes Sensitive Participatory Data

The National Vulnerability Database has detailed CVE-2026-40870, a high-severity vulnerability (CVSS 7.5) affecting Decidim, a participatory democracy framework. Versions from 0.0.1 up to, but not including, 0.30.5 and 0.31.1 are impacted. The core issue lies within the root-level commentable field in the API, which, by default, grants access to all commentable resources without proper permission checks. This means sensitive data intended for private participation spaces could be exposed if the /api endpoint is not secured.

All Decidim instances are vulnerable if the /api endpoint remains publicly accessible, which is the default configuration. While the National Vulnerability Database notes that the severity lessens if the platform primarily serves public data, it becomes critical when protecting private resources. The vulnerability’s scope is further limited for instances that have enabled the “Force users to authenticate before access organization” setting (introduced in 0.19.0 and applied to the /api endpoint in 0.22.0), restricting exposure to authenticated users only.

Patches are available in Decidim versions 0.30.5 and 0.31.1. For those unable to upgrade immediately, a workaround involves limiting /api endpoint access to authenticated users. This requires custom code or implementing the Decidim::Apiauth module. Alternatively, administrators can disable all traffic to the /api endpoint by removing allow statements, effectively mitigating the direct exposure.