CVE-2026-40870: Decidim API Authorization Bypass Vulnerability

CVE-2026-40870 Overview

CVE-2026-40870 is a Missing Authorization vulnerability (CWE-862) in Decidim, an open-source participatory democracy framework. The vulnerability exists in the root level commentable field within the GraphQL API, which allows access to all commentable resources on the platform without performing any permission checks. This authorization bypass enables unauthenticated attackers to access potentially sensitive data from private participation spaces through the publicly exposed /api endpoint.

Critical Impact

Unauthorized access to all commentable resources, potentially exposing private participation space data to unauthenticated attackers via the public API endpoint.

Affected Products

• Decidim versions 0.0.1 through 0.30.4
• Decidim versions 0.31.0
• All Decidim instances with unsecured /api endpoints (default configuration)

Discovery Timeline

• April 21, 2026 - CVE-2026-40870 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40870

Vulnerability Analysis

This vulnerability represents a Missing Authorization flaw (CWE-862) in Decidim's GraphQL API implementation. The root cause lies in the commentable field at the root level of the API schema, which returns all commentable resources without validating whether the requesting user has appropriate permissions to access them.

The attack surface is significant because the /api endpoint is publicly accessible by default in Decidim deployments. This means any unauthenticated user can query the API and retrieve data from commentable resources across the entire platform, including those within private participation spaces that should be restricted.

The impact varies based on the platform's configuration and data sensitivity. Platforms primarily serving public data face minimal risk, while those protecting resources within private participation spaces may experience unauthorized data exposure. Organizations that have enabled the "Force users to authenticate before access organization" setting (available since version 0.19.0 and applied to the /api endpoint in version 0.22.0) have a reduced attack surface limited to authenticated platform users.

Root Cause

The vulnerability stems from a missing authorization check in the GraphQL API's commentable field resolver. When processing queries against this field, the API retrieves and returns all commentable resources without verifying whether the requesting user has the necessary permissions to access each resource. This architectural oversight allows the API to bypass the platform's existing access control mechanisms for private participation spaces.

Attack Vector

An attacker can exploit this vulnerability by sending crafted GraphQL queries to the publicly accessible /api endpoint. The attack requires no authentication by default and can be executed remotely over the network. By querying the commentable field, the attacker can enumerate and extract data from resources that should be protected within private participation spaces.

The exploitation is straightforward: an attacker identifies a target Decidim instance, accesses the /api endpoint, and constructs GraphQL queries targeting the commentable field to retrieve unauthorized data. The attack requires no special privileges or user interaction.

Detection Methods for CVE-2026-40870

Indicators of Compromise

• Unusual or unexpected GraphQL queries targeting the commentable field from external IP addresses
• High volume of API requests from single sources attempting to enumerate commentable resources
• Access patterns to the /api endpoint that bypass normal authentication flows
• Log entries showing successful data retrieval from private participation spaces by unauthenticated users

Detection Strategies

• Monitor GraphQL query logs for requests specifically targeting the root-level commentable field
• Implement rate limiting and anomaly detection on the /api endpoint
• Review web server access logs for patterns of API enumeration activity
• Deploy web application firewall (WAF) rules to flag suspicious GraphQL query patterns

Monitoring Recommendations

• Enable verbose logging for the Decidim /api endpoint to capture all GraphQL queries
• Set up alerts for bulk data extraction attempts through the API
• Monitor for unauthorized access attempts to private participation space resources
• Implement real-time monitoring of API response sizes to detect large data exfiltration

How to Mitigate CVE-2026-40870

Immediate Actions Required

• Upgrade Decidim to version 0.30.5 or 0.31.1 which contain the security fix
• Audit API access logs for signs of prior exploitation
• Review what sensitive data may have been exposed through private participation spaces
• Consider temporarily restricting access to the /api endpoint until patching is complete

Patch Information

The Decidim development team has released patched versions that address this authorization bypass vulnerability. Organizations should upgrade to version 0.30.5 (for the 0.30.x branch) or version 0.31.1 (for the 0.31.x branch). For detailed patch information and the security advisory, refer to the GitHub Security Advisory.

Workarounds

• Limit API access to authenticated users only by implementing custom code or installing the third-party module Decidim::Apiauth
• Disable all traffic to the /api endpoint if the API functionality is not required
• Enable the "Force users to authenticate before access organization" setting to limit exposure to authenticated users only
• Deploy network-level access controls to restrict API endpoint access to trusted sources

# Configuration example - Restrict API access using nginx
# Add to your nginx server configuration block

location /api {
    # Option 1: Completely disable API access
    # return 403;
    
    # Option 2: Require authentication (basic example)
    # auth_basic "Restricted API";
    # auth_basic_user_file /etc/nginx/.htpasswd;
    
    # Option 3: IP-based restrictions
    # allow 192.168.1.0/24;
    # deny all;
    
    proxy_pass http://decidim_backend;
}