CVE-2024-27090

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.27.6

Description Decidim is a participatory democracy framework, written in Ruby on Rails. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded, then some data of this resource could be accessed.

Recommendations For versions prior to 0.27.6, update to version 0.27.6 to resolve the issue. As a temporary workaround, consider disallowing access through your web server to the URLs finished with /embed.html until the issue is resolved.