CVE-2026-40869

CVE-2026-40869 is an authorization bypass vulnerability in Decidim, an open-source participatory democracy platform, affecting versions 0.19.0 through 0.31.0. The flaw allows any authenticated user to accept or reject proposal amendments without proper authorization, potentially elevating attackers to coauthor status on original proposals. This impacts all instances where the amendments feature is enabled on proposals. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring only user authentication and no user interaction. The primary impact is integrity compromise, as attackers can manipulate amendment workflows and gain unauthorized coauthorship privileges on proposals. The attack has low complexity and requires minimal effort to execute. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows minimal community attention relative to other CVEs. Patches are available in versions 0.30.5 and 0.31.1, and administrators can implement a workaround by disabling amendment reactions on the amendable component until patching is possible.