Executive brief
Decidim, a popular open-source participatory democracy platform, contains a flaw in how it manages administrative permissions for census data. Users with 'participant manager' roles, who should only be able to manage user accounts, can bypass restrictions to access and modify sensitive CSV census records. This could allow an internal user to corrupt verification data, potentially interfering with the integrity of voting or authorization workflows within the platform.
Technical details
An improper authorization vulnerability (CWE-285) exists in the Decidim 'decidim-verifications' gem. The administrative endpoints located under `/admin/csv_census/census_logs` and the associated `census_records_controller` failed to enforce strict administrator-only permission checks. This allowed users with the 'participant manager' role to render and mutate `Decidim::Verifications::CsvDatum` objects. Specifically, the `index`, `destroy`, `new_import`, `new_record`, `create_record`, `edit_record`, and `update_record` actions lacked the necessary `enforce_permission_to` calls. This has been patched in versions 0.30.9, 0.31.5, and 0.32.0 by adding explicit authorization guards to the affected controllers.
Affected products
- Decidim decidim-verifications < 0.30.9, >= 0.31.0.rc1, < 0.31.5, >= 0.32.0.rc1, < 0.32.0
Timeline
- 2026-04-29: disclosed: Initial pull request for fix submitted
- 2026-05-10: patched: Final fix merged into develop branch
- 2026-07-13: advisory: GitHub Advisory published