Executive brief
Decidim is an open-source framework used by governments and organizations to host participatory democracy and voting platforms. A security flaw allows regular users to access and potentially modify the demographics questionnaire editor, a tool normally reserved for administrators. This could allow unauthorized individuals to change the questions asked of participants or view internal administrative interfaces, potentially undermining the integrity of the data collection process.
Technical details
A missing authorization check (CWE-862) exists in the Decidim Demographics module. The route under /admin/demographics/questions fails to verify if the requesting user has administrative privileges before rendering the editor interface. An authenticated participant can bypass intended access controls by navigating directly to the demographics questionnaire editor URL. This allows the attacker to view the management interface and potentially perform unauthorized updates to questionnaire structures. The issue is resolved in versions 0.31.5 and 0.32.0.rc2 by implementing proper permission subject checks in the QuestionsController.
Affected products
- decidim decidim-demographics >= 0.31.1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0.rc2
Timeline
- 2026-07-13: advisory: GHSA-vq6j-hj8w-7v39 published by maintainers
- 2026-07-31: disclosed: CVE published to NVD