A missing authorization flaw in the Decidim API allows unauthenticated remote attackers to access restricted platform data, necessitating an immediate update to version 0.30.5 or 0.31.1.

The vulnerability is a missing authorization flaw (CWE-862) located within the root level commentable field of the API. This flaw permits unauthenticated users to bypass security controls and retrieve data from private participation spaces.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation allows unauthorized parties to access sensitive information hosted within private participation spaces, potentially leading to unauthorized data exposure and reputational damage for organizations relying on the platform for confidential democratic processes.

Immediate Action: Upgrade all Decidim instances to version 0.30.5 or 0.31.1 immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review API access logs for unusual traffic patterns or unauthorized requests directed at the commentable resources endpoint.

Compensating Controls: If patching is delayed, restrict access to the API endpoint at the network or application level to require authentication, or disable the endpoint if it is not strictly necessary for current operations.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for sensitive data exposure, administrators must prioritize this update. Organizations that utilize Decidim to host private or sensitive participation spaces should verify their current version and apply the provided security updates without delay to ensure the integrity and confidentiality of their platform data.