Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-thew-scr1-p7hd
Vulnerability ID VCID-thew-scr1-p7hd
Aliases CVE-2024-27090
GHSA-qcj6-vxwx-4rqv
Summary Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2024-27090
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2024-27090
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-qcj6-vxwx-4rqv
cvssv3.1 5.3 https://github.com/decidim/decidim
cvssv4 6.9 https://github.com/decidim/decidim
generic_textual MODERATE https://github.com/decidim/decidim
cvssv3.1 5.3 https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
cvssv4 6.9 https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
generic_textual MODERATE https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
ssvc Track https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
cvssv3.1 5.3 https://github.com/decidim/decidim/pull/12528
cvssv4 6.9 https://github.com/decidim/decidim/pull/12528
generic_textual MODERATE https://github.com/decidim/decidim/pull/12528
ssvc Track https://github.com/decidim/decidim/pull/12528
cvssv3.1 5.3 https://github.com/decidim/decidim/releases/tag/v0.27.6
cvssv4 6.9 https://github.com/decidim/decidim/releases/tag/v0.27.6
generic_textual MODERATE https://github.com/decidim/decidim/releases/tag/v0.27.6
ssvc Track https://github.com/decidim/decidim/releases/tag/v0.27.6
cvssv3 5.3 https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
cvssv3.1 5.3 https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
cvssv3.1_qr MODERATE https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
cvssv4 6.9 https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
generic_textual MODERATE https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
ssvc Track https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
cvssv3.1 5.3 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
cvssv4 6.9 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-27090
cvssv4 6.9 https://nvd.nist.gov/vuln/detail/CVE-2024-27090
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-27090
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-27090
https://github.com/decidim/decidim
12528 https://github.com/decidim/decidim/pull/12528
1756fa639ef393ca8e8bb16221cab2e2e7875705 https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
CVE-2024-27090 https://nvd.nist.gov/vuln/detail/CVE-2024-27090
CVE-2024-27090.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
GHSA-qcj6-vxwx-4rqv https://github.com/advisories/GHSA-qcj6-vxwx-4rqv
GHSA-qcj6-vxwx-4rqv https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
v0.27.6 https://github.com/decidim/decidim/releases/tag/v0.27.6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/decidim/decidim
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/decidim/decidim
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-10T19:29:59Z/ Found at https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/decidim/decidim/pull/12528
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/decidim/decidim/pull/12528
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-10T19:29:59Z/ Found at https://github.com/decidim/decidim/pull/12528
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/decidim/decidim/releases/tag/v0.27.6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/decidim/decidim/releases/tag/v0.27.6
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-10T19:29:59Z/ Found at https://github.com/decidim/decidim/releases/tag/v0.27.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-10T19:29:59Z/ Found at https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-27090
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-27090
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56523
EPSS Score 0.00333
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:43:42.308785+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/27xxx/CVE-2024-27090.json 38.6.0