Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.

Patches

version 0.27.6

decidim/decidim@1756fa6

Workarounds

Disallow access through your web server to the URLs finished with /embed.html

References

• GHSA-qcj6-vxwx-4rqv
• decidim/decidim#12528
• decidim/decidim@1756fa6
• https://github.com/decidim/decidim/releases/tag/v0.27.6
• https://nvd.nist.gov/vuln/detail/CVE-2024-27090
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml