CVE-2026-45415 in Decidim
Summary
by MITRE • 08/07/2026
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects Decidim, an open-source participatory democracy framework designed to facilitate democratic processes through digital platforms. This security weakness specifically targets the administrative functionality of the system, particularly concerning census management operations within the verification module. The flaw exists in multiple version ranges including 0.30.8 and earlier, versions 0.31.0 through 0.31.4, and 0.32.0.rc1 before 0.32.0.rc2, creating a window of exposure for organizations relying on this platform for democratic participation processes.
The technical implementation defect resides in the /admin/csv_census/census_logs endpoints where proper authorization checks are insufficiently enforced. These endpoints handle Decidim::Verifications::CsvDatum records which represent census data used for verification purposes in participatory processes. The vulnerability allows unauthorized access because the system fails to verify that users possess complete administrative privileges before permitting operations on census records. This authorization bypass enables malicious actors or compromised participant managers to manipulate critical verification data without proper oversight.
The operational impact of this vulnerability is significant within the context of participatory democracy platforms where data integrity and verification processes are paramount. A participant manager with limited privileges could potentially create false census entries, modify existing records to alter verification outcomes, or delete crucial verification data that might be needed for audit purposes. This compromise directly affects the credibility and reliability of democratic processes managed through Decidim, as the verification mechanisms upon which participatory decisions rely become vulnerable to manipulation by unauthorized parties.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, specifically when access controls are insufficiently enforced for administrative functions. The flaw also relates to ATT&CK technique T1078 which covers valid accounts and privilege escalation through unauthorized access to administrative resources. Organizations using Decidim must consider that this vulnerability could enable attackers to manipulate the verification process, potentially compromising the entire participatory democracy framework's integrity and trustworthiness.
The fix implemented in versions 0.30.9, 0.31.5, and 0.32.0.rc2 addresses the authorization enforcement mechanism by ensuring that all operations on census records require full administrator privileges before execution. This remediation aligns with security best practices for protecting administrative functions and maintaining data integrity in collaborative platforms. Organizations should urgently upgrade to these fixed versions while also implementing additional monitoring of administrative access logs to detect any potential exploitation attempts during the vulnerability window.
The broader implications extend beyond simple access control, as this vulnerability affects the fundamental trust model of participatory democracy systems. When verification processes can be manipulated by users with partial privileges, it undermines the democratic integrity of the entire platform. The vulnerability demonstrates how insufficient authorization checking in administrative interfaces can create cascading security issues that compromise not just individual records but entire verification workflows essential for participatory decision-making processes.