← Vulnerability feed

Vulnerability record · CVE-2023-34090 · published 11 July 2023

CVE-2023-34090: Decidim information exposure vulnerability

Decidim · Decidim

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

7.5 CVSS 3.1 High EPSS 1.3% · top 31.6% CWE-200 · Information exposure
7.5CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/decidim/decidim/releases/tag/v0.27.3 PatchThird Party Advisory
https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9 Third Party Advisory
https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110 Third Party Advisory
https://github.com/decidim/decidim/releases/tag/v0.27.3 PatchThird Party Advisory
https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9 Third Party Advisory
https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110 Third Party Advisory

Track CVE-2023-34090 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-23891Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the …EPSS 0.36%8.2CVE-2025-65017Decidim information exposure vulnerabilityDecidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data expor…EPSS 0.28%7.4CVE-2023-48220Decidim vulnerabilityDecidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites fea…EPSS 0.79%7.1CVE-2023-36465Decidim improper access control vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.54%6.5CVE-2026-40869Decidim vulnerabilityDecidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any regist…EPSS 0.31%6.1CVE-2023-34089Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.74%6.1CVE-2023-32693Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.82%5.7CVE-2023-47635Decidim server-side request forgery (ssrf) vulnerabilityDecidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check…EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2023-34090), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.