Skip to content
OpenAdvisories

Package · RubyGems

decidim

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.5
    CVE-2026-45414

    Decidim: JWT-backed authentication can be replayed across organizations

    Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against anoth…

    decidim decidim decidim RubyGems
  • High 8.2
    CVE-2025-65017

    Decidim's private data exports can lead to data leaks

    Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue …

    decidim decidim decidim decidim-core RubyGems
  • High 7.1
    CVE-2024-41673

    Decidim has a cross-site scripting vulnerability in the version control page

    Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8.

    decidim decidim decidim RubyGems
  • High 7.1
    CVE-2024-32469

    Decidim has cross-site scripting (XSS) in the pagination

    Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1.

    decidim decidim decidim RubyGems
  • High 8.1
    CVE-2023-34089

    Decidim Cross-site Scripting vulnerability in the processes filter

    Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remot…

    decidim decidim decidim decidim-core RubyGems
  • High 7.5
    CVE-2023-34090

    Decidim vulnerable to sensitive data disclosure

    Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collecti…

    decidim decidim decidim decidim-meetings RubyGems
  • High 8.1
    CVE-2023-32693

    Decidim Cross-site Scripting vulnerability in the external link redirections

    Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote a…

    decidim decidim decidim decidim-core RubyGems