{"id":"CVE-2026-45415","aliases":["GHSA-q79h-67vx-m9xg"],"url":"https://o3.security/vulnerability/CVE-2026-45415","summary":"Decidim: CSV census record endpoints improper authorization","details":"## Description\n\nA participant manager can access and modify the CSV census record admin forms.\n\n## Technical description\n\nThe CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`.\n\nA participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly.\n\nReproduction steps:\n1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin.\n\n<img width=\"1541\" height=\"274\" alt=\"decidim-census-01\" src=\"https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3\" />\n\n<img width=\"1538\" height=\"363\" alt=\"decidim-census-02\" src=\"https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c\" />\n\nNote that normal participant accounts were not able to access the CSV census records which is good.\n\n### Impact\n \nAny participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 \n\n### Workarounds\n\nDisable Organization Census verification method\n\n### Reference\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-08-06T19:33:31.514Z","modified":"2026-10-21T02:58:06.815724048Z","cvss":{"score":6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L"},"epss":{"score":0.00458,"percentile":0.38772,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.30.9"},{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.31.5"},{"ecosystem":"RubyGems","name":"decidim-verifications","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/pull/16674","label":"decidim/decidim#16674"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45415.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-q79h-67vx-m9xg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45415"},{"type":"FIX","url":"https://github.com/decidim/decidim/pull/16674"},{"type":"FIX","url":"https://github.com/decidim/decidim/pull/16703"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:06.815724048Z"}}