CVE-2026-40869: Decidim Collaborative Texts Incorrect Authz Subjectcve-2026-40869-decidim-collaborative-texts-incorrect-authz-subject
The authorization check evaluates permissions using the incorrect subject `:document` instead of `:collaborative_text`. In the `decidim-collaborative_texts` component, component-specific permission bounds explicitly match `:collaborative_text`. Using `:document` bypasses expected authorization checks, which can lead to a fail-closed DoS or privilege escalati
