Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-06T22:17:07.020Z",
  "pubdate": "2026-08-06T22:17:07.020Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the Decidim participatory democracy framework, specifically affecting the record-management endpoints located at /admin/csv_census/census_logs. The root cause stems from the application failing to enforce full administrator authorization prior to rendering or mutating Decidim::Verifications::CsvDatum objects. This security flaw allows an authenticated user assigned to the participant manager role to improperly create, alter, or remove sensitive census records without possessing the required administrative privileges. The risk implications include unauthorized manipulation of participatory verification data, compromising the integrity of the census process within affected installations. Exploitation requires authenticated access with participant manager privileges to interact with the vulnerable administrative endpoints. The issue impacts Decidim versions prior to 0.30.9, versions from 0.31.0 before 0.31.5, and version 0.32.0.rc1 prior to 0.32.0.rc2. Remediation requires upgrading the framework to the patched versions where full administrative access controls are properly enforced on these endpoints.",
  "technicalDetails": "The vulnerability resides in the administrative routing and controller logic governing the /admin/csv_census/census_logs endpoints within the Decidim framework. Specifically, the component responsible for processing record-management actions fails to perform adequate access control checks to verify whether the initiating session possesses full administrator privileges before executing operations against Decidim::Verifications::CsvDatum models. While intended solely for full administrators, the endpoint improperly permits lower-privilege users, such as those with the participant manager role, to execute state-mutating requests and data retrieval operations. The attack flow begins with an authenticated attacker holding participant manager privileges who targets the /admin/csv_census/census_logs endpoints via HTTP requests. Due to the absence of rigorous authorization guards, the underlying controller accepts the request and interacts directly with the CsvDatum records. The attacker can supply payloads designed to create new census entries, modify existing verification data, or execute deletion routines against critical records. The network exposure is restricted to the administrative interface of the application, requiring prior authentication. However, the privilege requirements are circumvented because the endpoint relies on insufficient role-based access checks rather than verifying full administrative credentials. Post-exploitation impact includes the unauthorized alteration or corruption of participant census datasets, undermining the verification mechanisms core to the participatory processes managed by the platform. The vulnerability affects Decidim prior to version 0.30.9, versions 0.31.0 through 0.31.4, and version 0.32.0.rc1."
}