https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:10:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343791 EUVD-2026-343791 https://cve.radiocsirt.org/vuln/euvd-2026-343791 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45086 <p>Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.</p> <p>Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45086 https://cve.radiocsirt.org/vuln/ghsa-vq6j-hj8w-7v39 <p><strong>Affected:</strong> RubyGems: decidim-demographics</p> <p>## Description</p> <p>A participant can load the demographics questionnaire admin editor and make changes.</p> <p>## Technical description</p> <p>The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.</p> <p>Reproduction steps:</p> <p>Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question:</p> <p>&lt;img width=&#34;1522&#34; height=&#34;1174&#34; alt=&#34;decidim-questions-01&#34; src=&#34;https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8&#34; /&gt;</p> <p>Note that access was denied when attempting to see question responses or settings.</p> <p>### Impact</p> <p>- Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches</p> <p>See https://github.com/decidim/decidim/pull/16665</p> <p>### Workarounds</p> <p>Disable the &#34;decidim-demographics&#34; module</p> <p>### Reference</p> <p>OWASP A01:2021 Broken Access Control</p> <p>### Credits</p> <p>This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicall…</p> <p><strong>Affected:</strong> RubyGems: decidim-demographics</p> <p>## Description</p> <p>A participant can load the demographics questionnaire admin editor and make changes.</p> <p>## Technical description</p> <p>The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.</p> <p>Reproduction steps:</p> <p>Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question:</p> <p>&lt;img width=&#34;1522&#34; height=&#34;1174&#34; alt=&#34;decidim-questions-01&#34; src=&#34;https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8&#34; /&gt;</p> <p>Note that access was denied when attempting to see question responses or settings.</p> <p>### Impact</p> <p>- Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches</p> <p>See https://github.com/decidim/decidim/pull/16665</p> <p>### Workarounds</p> <p>Disable the &#34;decidim-demographics&#34; module</p> <p>### Reference</p> <p>OWASP A01:2021 Broken Access Control</p> <p>### Credits</p> <p>This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicall…</p> https://cve.radiocsirt.org/vuln/ghsa-vq6j-hj8w-7v39