Is CVE-2026-40869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40869 being exploited in the wild.

How severe is CVE-2026-40869?

High severity, with a CVSS score of 7.5, published 21 April 2026.

Which products and versions are affected?

decidim-core (RubyGems) ECOSYSTEM:introduced=0.31.0.rc1,fixed=0.31.1.

Is there a fix for CVE-2026-40869?

Yes. decidim-core (RubyGems): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40869 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40869?

Check whether you run Decidim or decidim-core (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40869: Decidim decidim-core incorrect privilege assignment in amendments

CVE-2026-40869 · Severity: high · CVSS 7.5 · Published 2026-04-21

Decidim, a framework for participatory democracy, contains a flaw where any registered user can accept or reject proposed changes (amendments) to proposals. This allows unauthorized individuals to manipulate community proposals and potentially gain co-authorship rights over content they did not create. This could lead to misinformation, unauthorized modification of community initiatives, and damage to the integrity of the democratic process.

Technologies: Decidim, decidim-core (RubyGems). Vendors: Decidim, RubyGems.

Quick answers

Is CVE-2026-40869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40869 being exploited in the wild.
How severe is CVE-2026-40869?: High severity, with a CVSS score of 7.5, published 21 April 2026.
Which products and versions are affected?: decidim-core (RubyGems) ECOSYSTEM:introduced=0.31.0.rc1,fixed=0.31.1.
Is there a fix for CVE-2026-40869?: Yes. decidim-core (RubyGems): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40869 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40869?: Check whether you run Decidim or decidim-core (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

decidim-core (RubyGems): upgrade to 0.31.1 or later
```
bundle update decidim-core
```

Technical details

An incorrect privilege assignment (CWE-266) in Decidim's permission logic allows any authenticated user to perform 'accept' or 'reject' actions on amendments. The root cause is located in `decidim-core/app/permissions/decidim/permissions.rb`, where the system only checks if amendment reactions are enabled for a component rather than verifying if the user has the authority to manage the specific amendment. Exploitation allows an attacker to modify the status of any amendment and gain co-authorship status on the associated resource. The issue was introduced in version 0.19.0 and is fixed in versions 0.30.5 and 0.31.1.

Affected products

Decidim decidim-core >= 0.19.0, < 0.30.5; >= 0.31.0.rc1, < 0.31.1

Identifiers

CVE-2026-40869
GHSA-w5xj-99cg-rccm

Timeline

2019-06-17: other: Vulnerability introduced in commit 1b99136 (v0.19.0)
2026-04-13: disclosed
2026-04-14: advisory
2026-04-21: other: NVD published CVE-2026-40869

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.