CVE-2026-45415

Decidim: CSV census record endpoints improper authorization

State: Published
Severity: 6.0 Medium
Published: Aug 6, 2026
Updated: Aug 7, 2026
Reserved: May 12, 2026

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Scores

CVSS	Score	Vector	Source
3.1	6.0 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L	GitHub_M

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
decidimdecidim	< 0.30.9Affected >= 0.31.0.rc1, < 0.31.5Affected >= 0.32.0.rc1, < 0.32.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.