CVE-2023-34090

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

• CWE-200

• https://github.com/decidim/decidim/releases/tag/v0.27.3Patch, Third Party Advisory
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9Third Party Advisory
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110Third Party Advisory
• https://github.com/decidim/decidim/releases/tag/v0.27.3Patch, Third Party Advisory
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9Third Party Advisory
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110Third Party Advisory

Published

Jul 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34085When an AWS DynamoDB table is used for user attribute storag…4.3
• CVE-2023-34086Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-34087An improper array index validation vulnerability exists in t…7.8
• CVE-2023-34088Collabora Online is a collaborative online office suite. A s…5.4
• CVE-2023-34089Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-3409The Bricks theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2023-34091Kyverno is a policy engine designed for Kubernetes. In versi…6.5
• CVE-2023-34092Vite provides frontend tooling. Prior to versions 2.9.16, 3.…7.5
• CVE-2023-34093Strapi is an open-source headless content management system.…7.1
• CVE-2023-34094ChuanhuChatGPT is a graphical user interface for ChatGPT and…5.3
• CVE-2023-34095cpdb-libs provides frontend and backend libraries for the Co…9.8
• CVE-2023-34096Thruk is a multibackend monitoring webinterface which curren…8.8