CVE-2023-47634

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.

• CWE-362
• CWE-362

• https://github.com/decidim/decidim/releases/tag/v0.26.9Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
• https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2Vendor Advisory
• https://github.com/decidim/decidim/releases/tag/v0.26.9Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
• https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2Vendor Advisory

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47628DataHub is an open-source metadata platform. DataHub Fronten…4.8
• CVE-2023-47629DataHub is an open-source metadata platform. In affected ver…8
• CVE-2023-4763Use after free in Networks in Google Chrome prior to 116.0.5…8.8
• CVE-2023-47630Kyverno is a policy engine designed for Kubernetes. An issue…7.1
• CVE-2023-47631vantage6 is a framework to manage and deploy privacy enhanci…8.8
• CVE-2023-47633Traefik is an open source HTTP reverse proxy and load balanc…7.5
• CVE-2023-47635Decidim is a participatory democracy framework. Starting in …5.7
• CVE-2023-47636The Pimcore Admin Classic Bundle provides a Backend UI for P…5.3
• CVE-2023-47637Pimcore is an Open Source Data & Experience Management Platf…8.8
• CVE-2023-47638Rejected reason: Confirm reference is not public.
• CVE-2023-47639API Platform Core is a system to create hypermedia-driven RE…5.3
• CVE-2023-4764Incorrect security UI in BFCache in Google Chrome prior to 1…6.5