CVE-2023-36465
Decidim has broken access control in templates
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Decidim has broken access control in templates
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Record
CVE-2023-36465- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2023-2663
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Record
EUVD-2023-2663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-639h-86hw-qcjq
Decidim has broken access control in templates
Impact
The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
- Record
GHSA-639h-86hw-qcjq- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-284, CWE-732
- Updated
- 2026-11-02
NVD
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Record
CVE-2023-36465- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-284, CWE-732
- Updated
- 2026-11-02
OSV
Decidim has broken access control in templates
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Record
CVE-2023-36465- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-639h-86hw-qcjq
Decidim has broken access control in templates
Impact
The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
- Record
GHSA-639h-86hw-qcjq- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-284, CWE-732
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
decidimRubyGems |
0.23.2 up to 0.26.8 | 0.26.8 |
decidim-templatesRubyGems |
0.23.2 up to 0.26.8 | 0.26.8 |
decidim-templatesRubyGems |
0.27.0 up to 0.27.4 | 0.27.4 |
decidimRubyGems |
0.27.0 up to 0.27.4 | 0.27.4 |
decidimRubyGems |
0.23.2 up to 0.26.8, plus listed versions 0.23.30.23.40.23.50.23.60.24.0 Show 20 moreShow less0.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc20.26.10.26.20.26.30.26.40.26.50.26.7 |
0.26.8 |
decidim-templatesRubyGems |
0.23.2 up to 0.26.8, plus listed versions 0.23.30.23.40.23.50.23.60.24.0 Show 21 moreShow less0.24.0.rc10.24.0.rc20.24.10.24.20.24.30.25.00.25.0.rc10.25.0.rc20.25.0.rc30.25.0.rc40.25.10.25.20.26.00.26.0.rc10.26.0.rc20.26.10.26.20.26.30.26.40.26.50.26.7 |
0.26.8 |
decidim-templatesRubyGems |
0.27.0 up to 0.27.4, plus listed versions 0.27.10.27.20.27.3 |
0.27.4 |
decidimRubyGems |
0.27.0 up to 0.27.4, plus listed versions 0.27.10.27.20.27.3 |
0.27.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36465 is a critical vulnerability (CVSS 9.1) in Decidim, published October 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in decidim 0.26.8.
References
github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
nvd.nist.gov/vuln/detail/CVE-2023-36465