CVE-2024-27090 - CVE House
Back to Database
Status published Medium CVE-2024-27090

Decidim vulnerable to data disclosure through the embed feature

Vulnerability Description

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-27090

Credits & Attribution

No credits recorded in the NVD database.

References

More from decidim

View All →
CVE-2025-65017
Decidim's private data exports can lead to data leaks
High 8.2
CVE-2024-45594
Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds
High 7.7
CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the version control page
High 7.1
CVE-2024-39910
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
Medium 5.4
CVE-2024-32469
Decidim has cross-site scripting (XSS) in the pagination
High 7.1

Affected Vendor

Affected Software

decidim
Vulnerable Versions:
< 0.27.6

Timeline

Official Publish: July 10th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration