Authorization Bypass in Decidim Participatory Democracy Framework
CVE-2026-45415
6MEDIUM
What is CVE-2026-45415?
In the Decidim Participatory Democracy Framework, a vulnerability exists that allows participant managers to manage census records without proper administrator authorization. Specifically, the record-management endpoints located at /admin/csv_census/census_logs fail to enforce necessary permissions, enabling unauthorized alterations to sensitive data. This issue affects multiple versions of Decidim and has been addressed in subsequent patches, including versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Affected Version(s)
decidim < 0.30.9 < 0.30.9
decidim >= 0.31.0.rc1, < 0.31.5 < 0.31.0.rc1, 0.31.5
decidim >= 0.32.0.rc1, < 0.32.0 < 0.32.0.rc1, 0.32.0