CVE-2024-27090

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-270916.1GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within CVE-2024-270925.4Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send ema CVE-2024-270937.5Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository CVE-2024-270947.4OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating CVE-2024-270954.8Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify so CVE-2024-270966.5GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-270975.3A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an at CVE-2024-270989.6GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-270999.8The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cau CVE-2024-27108.8A vulnerability was found in Tenda AC10U 15.03.06.49. It has been declared as critical. Affected by this vulnerability is the function setSc CVE-2024-271006.5Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and CVE-2024-271019.1SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer ov