CVE-2026-40869: Decidim Collaborative Texts Incorrect Authz Subject
The authorization check evaluates permissions using the incorrect subject `:document` instead of `:collaborative_text`. In the `decidim-collaborative_texts` component, component-specific permission bounds explicitly match `:collaborative_text`. Using `:document` bypasses expected authorization checks, which can lead to a fail-closed DoS or privilege escalati
Rubygreprules fetch cve-2026-40869-decidim-collaborative-texts-incorrect-authz-subject --engine opengrepDescription
The authorization check evaluates permissions using the incorrect subject `:document` instead of `:collaborative_text`. In the `decidim-collaborative_texts` component, component-specific permission bounds explicitly match `:collaborative_text`. Using `:document` bypasses expected authorization checks, which can lead to a fail-closed DoS or privilege escalati
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.