decidim-demographics CVE-2026-45086
MEDIUM
GHSA-vq6j-hj8w-7v39
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible missing authorization requires only a low-privilege authenticated session; confidentiality and integrity impacts are both low as only the question editor surface is exposed, with no availability impact.
Primary rating from Vendor (https://github.com/decidim/decidim).
CVSS VectorVendor: https://github.com/decidim/decidim
Lifecycle Timeline
2DescriptionCVE.org
Description
A participant can load the demographics questionnaire admin editor and make changes.
Technical description
The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.
Reproduction steps:
Step 1. Sign in as a normal participant: Open http://localhost:3000/users/sign_in. Step 2. Request the admin-only editor directly. Open http://localhost:3000/admin/demographics/questions/edit_questions in the same browser. Step 3. Add another question:
<img width="1522" height="1174" alt="decidim-questions-01" src="https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8" />
Note that access was denied when attempting to see question responses or settings.
Impact
- Low-privilege users can access questionnaire-admin interfaces.
- They can read question-management surfaces that should remain limited to questionnaire managers.
Patches
See https://github.com/decidim/decidim/pull/16665
Workarounds
Disable the "decidim-demographics" module
Reference
OWASP A01:2021 Broken Access Control
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
AnalysisAI
Unauthorized access to the demographics questionnaire admin editor in Decidim's decidim-demographics module allows any authenticated participant to reach and interact with the /admin/demographics/questions/edit_questions route without admin privileges. Affected versions span 0.31.0-0.31.4 and 0.32.0.rc1, with fixes released in 0.31.5 and 0.32.0. The vulnerability is not listed in CISA KEV and no separate public exploit code has been identified; however, the advisory published by Decidim includes step-by-step reproduction instructions, lowering the barrier for exploitation by any registered platform user.
Technical ContextAI
Decidim is a Ruby on Rails-based open-source participatory democracy platform. The affected component is the decidim-demographics gem (pkg:rubygems/decidim-demographics), which provides a demographic questionnaire feature for collecting participant data. The root cause (CWE-284: Improper Access Control) is a missing permission_subject declaration in Decidim::Demographics::Admin::QuestionsController. The controller inherits from Admin::ApplicationController and relies on the has_questionnaire concern, which calls enforce_permission_to(:update, permission_subject). Prior to the fix, the edit_questions and update actions in the demographics controller did not invoke this permission check at all, and the default permission_subject was :questionnaire rather than the demographics-specific :demographics subject. The patch (PR #16665) adds def permission_subject = :demographics to the controller and inserts the missing enforce_permission_to calls into both edit_questions and update actions, ensuring the demographics permission subject is evaluated against the admin permissions framework.
RemediationAI
Upgrade decidim-demographics to version 0.31.5 if running the 0.31.x series, or to 0.32.0 if running the 0.32.x series. The patch is available at https://github.com/decidim/decidim/pull/16665 and adds the missing authorization enforcement to the edit_questions and update actions in QuestionsController. If an immediate upgrade is not feasible, the official workaround is to disable the decidim-demographics module entirely, which removes the exposed route from the application. Disabling the module will also remove all demographics questionnaire functionality for administrators and participants, so assess operational impact before applying this workaround. No other partial mitigations (such as network-layer controls) are practical given that the route requires only a valid authenticated session over standard HTTPS.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today