Detections
Analytics

SCA: security update for decidim, decidim-admin, decidim-system, devise_invitable (GHSA-w3q8-m492-4pwp)

high Tenable Self-Hosted Container Security Plugin ID 419664

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of
 the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited
 amount of time through the password reset functionality. This issue creates vulnerable dependencies
 starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,`
 `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the
 `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check
 done is if the user has been invited but the code does not ensure that the pending invitation is still
 valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this
 configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and
 the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version
 `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`,
 and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from
 the database. (CVE-2023-48220)

Solution

Update the decidim library and its related packages to version 0.26.9 or later.

See Also

https://github.com/advisories/GHSA-w3q8-m492-4pwp

Plugin Details

Severity: High

ID: 419664

Version: Revision 1.24

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.19

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2023-48220

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/20/2024

Vulnerability Publication Date: 2/20/2024

Reference Information

CVE: CVE-2023-48220

cwe: CWE-672