Unauthorized Access in Decidim Participatory Democracy Framework
CVE-2026-45086
5.4MEDIUM
What is CVE-2026-45086?
A vulnerability exists in the Decidim framework that allows participants to access the demographics questionnaire editor without proper administrator authorization. This flaw occurs due to inadequate access controls on the route '/admin/demographics/questions/edit_questions', enabling non-admin users to load an interface meant for administrators. Users can view sensitive forms and data, which can lead to unauthorized modifications. The vulnerability is addressed in versions 0.31.5 and 0.32.0.rc2.
Affected Version(s)
decidim >= 0.31.1, < 0.31.5 < 0.31.1, 0.31.5
decidim >= 0.32.0.rc1, < 0.32.0.rc2 < 0.32.0.rc1, 0.32.0.rc2