{"id":"CVE-2026-45086","aliases":["EUVD-2026-51664","GHSA-vq6j-hj8w-7v39"],"status":"published","title":"Decidim: Forms admin question editor lacks authorization","description":"Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00294,"percentile":0.22281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-862"],"published":"2026-07-13T16:51:05Z","modified":"2026-11-11T02:48:52Z","fixes":[{"ecosystem":"RubyGems","package":"decidim-demographics","fixed_in":["0.31.5","0.32.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"decidim-demographics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.31.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"decidim-demographics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.32.0.rc1"},{"fixed":"0.32.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"decidim-demographics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.31.5"}]}],"versions":["0.31.0","0.31.1","0.31.2","0.31.3","0.31.4"]},{"source":"osv","ecosystem":"RubyGems","package":"decidim-demographics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.32.0.rc1"},{"fixed":"0.32.0"}]}],"versions":["0.32.0.rc1","0.32.0.rc2","0.32.0.rc3"]}],"products":[{"vendor":"decidim","product":"decidim"}],"references":[{"url":"https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/decidim/decidim/commit/fa52fb631a0788b30895d1312728a888607d81b5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/decidim/decidim/commit/fc89301c6697c6101a7aed3fced3fa8311048cb9","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/decidim/decidim/pull/16665","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vq6j-hj8w-7v39"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45086.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45086","tags":["advisory"]},{"url":"https://github.com/decidim/decidim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45086","title":"Decidim: Forms admin question editor lacks authorization","description":"Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.","status":"published","published":"2026-07-31T21:44:11.803Z","modified":"2026-08-03T17:16:23.64Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-51664","description":"Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.","status":"published","published":"2026-07-31T21:44:11Z","modified":"2026-08-03T17:16:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.01774Z"}],"ghsa":[{"id":"GHSA-vq6j-hj8w-7v39","title":"Decidim: Forms admin question editor lacks authorization","description":"## Description\n\nA participant can load the demographics questionnaire admin editor and make changes.\n\n## Technical description\n\nThe demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.\n\nReproduction steps:\n\nStep 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`.\nStep 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser.\nStep 3. Add another question:\n\n\u003cimg width=\"1522\" height=\"1174\" alt=\"decidim-questions-01\" src=\"https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8\" /\u003e\n\nNote that access was denied when attempting to see question responses or settings.\n\n### Impact\n\n- Low-privilege users can access questionnaire-admin interfaces.\n- They can read question-management surfaces that should remain limited to questionnaire managers.\n \n### Patches\n\nSee https://github.com/decidim/decidim/pull/16665 \n\n### Workarounds\n\nDisable the \"decidim-demographics\" module \n\n### Reference\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","status":"published","published":"2026-07-13T16:51:05Z","modified":"2026-07-13T16:51:06Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:42.703776Z"}],"nvd":[{"id":"CVE-2026-45086","description":"Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.","status":"published","published":"2026-07-31T22:17:02.157Z","modified":"2026-09-08T20:51:43.49Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-45086","title":"Decidim: Forms admin question editor lacks authorization","description":"Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.","status":"published","published":"2026-07-31T21:44:11.803Z","modified":"2026-11-11T10:47:31.450308577Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"GHSA-vq6j-hj8w-7v39","title":"Decidim: Forms admin question editor lacks authorization","description":"## Description\n\nA participant can load the demographics questionnaire admin editor and make changes.\n\n## Technical description\n\nThe demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.\n\nReproduction steps:\n\nStep 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`.\nStep 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser.\nStep 3. Add another question:\n\n\u003cimg width=\"1522\" height=\"1174\" alt=\"decidim-questions-01\" src=\"https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8\" /\u003e\n\nNote that access was denied when attempting to see question responses or settings.\n\n### Impact\n\n- Low-privilege users can access questionnaire-admin interfaces.\n- They can read question-management surfaces that should remain limited to questionnaire managers.\n \n### Patches\n\nSee https://github.com/decidim/decidim/pull/16665 \n\n### Workarounds\n\nDisable the \"decidim-demographics\" module \n\n### Reference\n\nOWASP A01:2021 Broken Access Control\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","status":"published","published":"2026-07-13T16:51:05Z","modified":"2026-07-13T17:11:53.826837Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}