CVE-2026-45415

Received Received - Intake

Authorization Bypass in Decidim Census Logs

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-45415

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	to 0.30.9 (inc)
decidim	decidim	From 0.31.0 (inc) to 0.31.5 (exc)
decidim	decidim	From 0.32.0.rc1 (inc) to 0.32.0.rc2 (exc)
decidim	decidim	to 0.31.5 (inc)
decidim	decidim	to 0.32.0.rc2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Decidim, a participatory democracy framework. It allows participant managers to perform unauthorized actions on census records due to insufficient administrator authorization checks in the /admin/csv_census/census_logs endpoints. Affected versions are before 0.30.9, between 0.31.0 and 0.31.4, and 0.32.0.rc1.

Detection Guidance

Check Decidim version with: bundle exec rake decidim:version. If version is <0.30.9, 0.31.0-0.31.4, or 0.32.0.rc1, the system is vulnerable. Inspect admin/csv_census/census_logs endpoints for unauthorized access attempts or unusual census record changes.

Impact Analysis

An attacker with participant manager privileges could create, modify, or delete census records without proper authorization. This could lead to inaccurate or manipulated census data, undermining the integrity of participatory democracy processes.

Mitigation Strategies

Upgrade Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2 immediately. Review and audit all census records for unauthorized modifications. Restrict participant manager roles to prevent access to vulnerable endpoints until patched.

Hi! I’m here to help you understand CVE-2026-45415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70