CVE-2023-47634

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
decidim	decidim	>= 0.10.0, < 0.26.9; >= 0.27.0, < 0.27.5

References

https://github.com/decidim/decidim/releases/tag/v0.26.9Release Notes
https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2Vendor Advisory
https://github.com/decidim/decidim/releases/tag/v0.26.9Release Notes
https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2Vendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-476355.7Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity to CVE-2023-476365.3The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see th CVE-2023-476378.8Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilt CVE-2023-476395.3API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HT CVE-2023-47646.5Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (UR CVE-2023-476408.8DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the f CVE-2023-476416.5aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability r CVE-2023-476424.3Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been s CVE-2023-476435.3SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without CVE-2023-476448.8Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue a CVE-2023-476458.8Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payme CVE-2023-476464.8Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vulnerability in CedCommerce Recently viewed and most viewed products plugin <= 1.1.