Most recent entries from all

EUVD-2026-343791

2026-10-07T01:49:16.684491+00:00

EUVD-2026-343791

fkie_cve-2026-45086

2026-10-07T01:49:16.684532+00:00

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

GHSA-vq6j-hj8w-7v39 — Decidim: Forms admin question editor lacks authorization

2026-10-07T01:49:16.684570+00:00

Affected: RubyGems: decidim-demographics

## Description

A participant can load the demographics questionnaire admin editor and make changes.

## Technical description

The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.

Reproduction steps:

Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question:

Note that access was denied when attempting to see question responses or settings.

### Impact

- Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches

See https://github.com/decidim/decidim/pull/16665

### Workarounds

Disable the "decidim-demographics" module

### Reference

OWASP A01:2021 Broken Access Control

### Credits

This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicall…