CVE-2026-45086

Received Received - Intake

Authorization Bypass in Decidim Demographics Editor

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-45086

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	From 0.31.1 (inc) to 0.31.5 (exc)
decidim	decidim	From 0.32.0.rc1 (inc) to 0.32.0.rc2 (exc)
decidim	decidim	0.31.5
decidim	decidim	0.32.0.rc2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Decidim allows a regular participant to access the demographics questionnaire editor without proper administrator authorization. The route /admin/demographics/questions/edit_questions should restrict access to admins only but fails to enforce this, letting non-admin users reach the editor interface.

Detection Guidance

Check if the affected Decidim versions (0.31.1 to 0.31.4 and 0.32.0.rc1) are installed. Verify if the route /admin/demographics/questions/edit_questions is accessible without admin privileges by attempting to access it directly.

Impact Analysis

An attacker could exploit this to modify or view sensitive demographic data without authorization. This could lead to data tampering, privacy breaches, or unauthorized changes to questionnaires affecting participatory democracy processes.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without proper access controls. It may also breach HIPAA if demographic data includes health-related information, as unauthorized access to sensitive data is a compliance failure.

Mitigation Strategies

Upgrade Decidim to version 0.31.5 or 0.32.0.rc2 or later to fix the authorization bypass. Ensure admin access controls are properly enforced on all administrative routes.

Hi! I’m here to help you understand CVE-2026-45086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70