https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:18:09.807941+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349335 EUVD-2026-349335 2026-10-07T21:18:10.104521+00:00 EUVD-2026-349335 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45415 fkie_cve-2026-45415 2026-10-07T21:18:10.104585+00:00

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

 https://cve.radiocsirt.org/vuln/ghsa-q79h-67vx-m9xg GHSA-q79h-67vx-m9xg — Decidim: CSV census record endpoints improper authorization 2026-10-07T21:18:10.104657+00:00

Affected: RubyGems: decidim-verifications

## Description

A participant manager can access and modify the CSV census record admin forms.

## Technical description

The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`.

A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly.

Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin.

<img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" />

<img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" />

Note that normal participant accounts were not able to access the CSV census records which is good.

### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows.

### Patches

See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703

### Workarounds

Disable Organization Census verification method

### Reference

OWASP A01:2021 Broken Access Control

### Credits

This issue was discove…