|
| 1 | +--- |
| 2 | +layout: advisory |
| 3 | +title: 'CVE-2026-40870 (decidim-comments): Decidim''s comments API allows access to |
| 4 | + all commentable resources' |
| 5 | +comments: false |
| 6 | +categories: |
| 7 | +- decidim-comments |
| 8 | +advisory: |
| 9 | + gem: decidim-comments |
| 10 | + cve: 2026-40870 |
| 11 | + ghsa: ghmh-q25g-gxxx |
| 12 | + url: https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx |
| 13 | + title: Decidim's comments API allows access to all commentable resources |
| 14 | + date: 2026-04-14 |
| 15 | + description: |- |
| 16 | + ### Impact |
| 17 | +
|
| 18 | + The root level `commentable` field in the API allows access to all |
| 19 | + commentable resources within the platform, without any permission |
| 20 | + checks. All Decidim instances are impacted that have not secured |
| 21 | + the `/api` endpoint. The `/api` endpoint is publicly available |
| 22 | + with the default configuration. |
| 23 | +
|
| 24 | + ### Patches |
| 25 | +
|
| 26 | + Not available |
| 27 | +
|
| 28 | + ### Workarounds |
| 29 | +
|
| 30 | + To mitigate the issue, you can limit the scope to only authenticated |
| 31 | + users by limiting access to the `/api` endpoint. This would require |
| 32 | + custom code or installing the 3rd party module `Decidim::Apiauth`. |
| 33 | +
|
| 34 | + With custom code, the `/api` endpoint can be limited to only |
| 35 | + authenticated users with the following code (needs to run during |
| 36 | + application initialization): |
| 37 | +
|
| 38 | + ```ruby |
| 39 | + # Within your application |
| 40 | + # config/initializers/limit_api_access.rb |
| 41 | +
|
| 42 | + module LimitApiAccess |
| 43 | + extend ActiveSupport::Concern |
| 44 | +
|
| 45 | + included do |
| 46 | + prepend_before_action do |controller| |
| 47 | + unless controller.send(:user_signed_in?) |
| 48 | + render plain: I18n.t("actions.login_before_access", |
| 49 | + scope: "decidim.core"), status: :unauthorized |
| 50 | + end |
| 51 | + end |
| 52 | + end |
| 53 | + end |
| 54 | +
|
| 55 | + Rails.application.config.to_prepare do |
| 56 | + Decidim::Api::ApplicationController.include(LimitApiAccess) |
| 57 | + end |
| 58 | + ``` |
| 59 | +
|
| 60 | + Please note that this would only disable public access to the API |
| 61 | + and all authenticated users would be still able to exploit the |
| 62 | + vulnerability. This may be sufficient for some installations, |
| 63 | + but not for all. |
| 64 | +
|
| 65 | + Another workaround is to limit the availability of the `/api` |
| 66 | + endpoint to only trusted ranges of IPs that need to access the |
| 67 | + API. The following Nginx configuration would help limiting the |
| 68 | + API access to only specific IPs: |
| 69 | +
|
| 70 | + ``` |
| 71 | + location /api { |
| 72 | + allow 192.168.1.100; |
| 73 | + allow 192.168.1.101; |
| 74 | + deny all; |
| 75 | + } |
| 76 | + ``` |
| 77 | +
|
| 78 | + The same configuration can be also used without the `allow` |
| 79 | + statements to disable all traffic to the the `/api` endpoint. |
| 80 | +
|
| 81 | + When considering a workaround and the seriousness of the vulnerability, |
| 82 | + please consider the nature of the platform. If the platform is primarily |
| 83 | + serving public data, this vulnerability is not serious by its nature. |
| 84 | + If the platform is protecting some resources, e.g. inside private |
| 85 | + participation spaces, the vulnerability may expose some data to |
| 86 | + the attacker that is not meant public. |
| 87 | +
|
| 88 | + If you have enabled the organization setting "Force users to |
| 89 | + authenticate before access organization", the scope of this |
| 90 | + vulnerability is limited to the users who are allowed to log in |
| 91 | + to the Decidim platform. This setting was introduced in version |
| 92 | + 0.19.0 and it was applied to the `/api` endpoint in version 0.22.0. |
| 93 | + cvss_v3: 7.5 |
| 94 | + unaffected_versions: |
| 95 | + - "< 0.0.1" |
| 96 | + patched_versions: |
| 97 | + - "~> 0.30.5" |
| 98 | + - ">= 0.31.1" |
| 99 | + related: |
| 100 | + url: |
| 101 | + - https://nvd.nist.gov/vuln/detail/CVE-2026-40870 |
| 102 | + - https://github.com/decidim/decidim/security/advisories/GHSA-ghmh-q25g-gxxx |
| 103 | + - https://github.com/advisories/GHSA-ghmh-q25g-gxxx |
| 104 | +--- |
0 commit comments