What is the CVSS score of CVE-2026-45415?

CVE-2026-45415 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-45415?

Yes, a patch is available for CVE-2026-45415. Update the affected software to the latest version immediately.

Decidim Verifications CVE-2026-45415

EUVD-2026-54236 MEDIUM

Improper Authorization (CWE-285)

2026-07-13 https://github.com/decidim/decidim

GHSA-q79h-67vx-m9xg

Authentication Bypass

6.0

CVSS 3.1 · Vendor: https://github.com/decidim/decidim

Severity by source

Vendor (https://github.com/decidim/decidim) PRIMARY

6.0 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

6.0 MEDIUM

Network vector because the admin panel is web-accessible; PR:H because participant manager is an authenticated privileged role; I:H for full census data mutation; C:L for census record read access; A:L for potential deletion of verification records.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N

Primary rating from Vendor (https://github.com/decidim/decidim).

CVSS VectorVendor: https://github.com/decidim/decidim

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 19:40 vuln.today

Analysis Generated

Jul 13, 2026 - 19:40 vuln.today

DescriptionCVE.org

Description

A participant manager can access and modify the CSV census record admin forms.

Technical description

The CSV census admin record-management surface under /admin/csv_census/census_logs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum.

A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly.

Reproduction steps:

Sign in a participant admin and open http://localhost:3000/admin/csv_census/census_logs/new_record in the browser. Confirm the create form loads even though the session is not a full admin.

Note that normal participant accounts were not able to access the CSV census records which is good.

Impact

Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows.

Patches

See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703

Workarounds

Disable Organization Census verification method

Reference

OWASP A01:2021 Broken Access Control

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

AnalysisAI

Improper authorization in Decidim's CSV census admin controller allows participant managers to read, create, update, and delete CSV census rows they are not permitted to access. The /admin/csv_census/census_logs endpoint family in decidim-verifications fails to call enforce_permission_to before rendering or mutating Decidim::Verifications::CsvDatum, granting participant managers the same data-mutation capability as full administrators. Exploitation corrupts the verification dataset that drives Decidim's authorization workflows, potentially invalidating or fabricating eligibility records for all participants. No public exploit code has been identified at time of analysis, but detailed reproduction steps are included in the public security advisory.

Technical ContextAI

Decidim is a Ruby on Rails participatory democracy platform distributed as a family of RubyGems. The affected component is decidim-verifications (CPE: pkg:rubygems/decidim-verifications), which implements the Organization Census verification method - a mechanism that compares a participant's identity attributes against a CSV-imported dataset stored as Decidim::Verifications::CsvDatum records. The vulnerable controller Decidim::Verifications::CsvCensus::Admin::CensusController inherits from Decidim::Admin::ApplicationController but omitted calls to the framework's enforce_permission_to guard before the index, destroy, new_import, and create_import actions. CWE-285 (Improper Authorization) is the precise root cause: the application authenticates the session but does not verify that the authenticated role (participant manager / process admin) holds the :authorization permission required for census management. The fix, visible in PR #16674, adds enforce_permission_to :index, :authorization, enforce_permission_to :destroy, :authorization, and enforce_permission_to :create, :authorization to the respective controller actions and adds regression tests covering the process_admin role.

RemediationAI

Upgrade decidim-verifications to a fixed release: 0.30.9 for installations on the 0.30.x branch, 0.31.5 for the 0.31.x branch, or 0.32.0 for the 0.32.x branch. Patch PRs are https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703; note that these are GitHub PR references and released gem versions should be obtained from RubyGems.org after the vendor publishes the tagged release. The vendor-documented workaround is to disable the Organization Census verification method in the Decidim admin panel; this eliminates the attack surface entirely but also removes CSV-based participant verification functionality for the organization, which may break authorization workflows that depend on it. No other compensating controls are documented in the advisory.