{"action":"Upgrade decidim to 0.26.9 or later.","affected":[{"fixed":"0.26.9","introduced":"0.0.1.alpha3"},{"fixed":"0.27.5","introduced":"0.27.0"}],"component":"decidim","cve_ids":["CVE-2023-48220"],"ecosystem":"RubyGems","epss":0.00791,"exploited":false,"fixed_versions":["0.26.9","0.27.5"],"ghsa_id":"GHSA-w3q8-m492-4pwp","id":"tcs_01M5KENRX6F06GPFKT1XM0AYQ9","modified_at":"2026-09-10T03:50:00.851414970Z","published_at":"2024-02-20T19:26:51Z","references":["https://osv.dev/vulnerability/GHSA-w3q8-m492-4pwp","https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp","https://nvd.nist.gov/vuln/detail/CVE-2023-48220","https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34","https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454","https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098","https://github.com/decidim/decidim","https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134","https://github.com/decidim/decidim/releases/tag/v0.26.9","https://github.com/decidim/decidim/releases/tag/v0.27.5","https://github.com/decidim/decidim/releases/tag/v0.28.0","https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-w3q8-m492-4pwp","url":"https://osv.dev/vulnerability/GHSA-w3q8-m492-4pwp"}],"summary":"Possibility to circumvent the invitation token expiry period"}