Is CVE-2026-45415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45415 being exploited in the wild.

How severe is CVE-2026-45415?

Medium severity, with a CVSS score of 6, published 6 August 2026.

Which products and versions are affected?

Decidim Verifications = 0.31.0.rc1, = 0.32.0.rc1, < 0.32.0; decidim-verifications (RubyGems) ECOSYSTEM:introduced=0,fixed=0.30.9.

Is there a fix for CVE-2026-45415?

Yes. decidim-verifications (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45415 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45415?

Check whether you run Decidim Verifications or decidim-verifications (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45415: Decidim decidim-verifications improper authorization in CSV census admin endpoints

Q: Is there a fix for CVE-2026-45415?

Yes. decidim-verifications (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45415 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45415?

Check whether you run Decidim Verifications or decidim-verifications (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45415 · Severity: medium · CVSS 6 · Published 2026-08-06

Decidim, a popular open-source participatory democracy platform, contains a flaw in how it manages administrative permissions for census data. Users with 'participant manager' roles, who should only be able to manage user accounts, can bypass restrictions to access and modify sensitive CSV census records. This could allow an internal user to corrupt verification data, potentially interfering with the integrity of voting or authorization workflows within the platform.

Technologies: decidim-verifications (RubyGems). Vendors: Decidim, RubyGems.

Quick answers

Is CVE-2026-45415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45415 being exploited in the wild.
How severe is CVE-2026-45415?: Medium severity, with a CVSS score of 6, published 6 August 2026.
Which products and versions are affected?: Decidim Verifications < 0.30.9, >= 0.31.0.rc1, < 0.31.5, >= 0.32.0.rc1, < 0.32.0; decidim-verifications (RubyGems) ECOSYSTEM:introduced=0,fixed=0.30.9.
Is there a fix for CVE-2026-45415?: Yes. decidim-verifications (RubyGems): upgrade to 0.30.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45415 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45415?: Check whether you run Decidim Verifications or decidim-verifications (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

decidim-verifications (RubyGems): upgrade to 0.30.9 or later
```
bundle update decidim-verifications
```

Technical details

An improper authorization vulnerability (CWE-285) exists in the Decidim 'decidim-verifications' gem. The administrative endpoints located under `/admin/csv_census/census_logs` and the associated `census_records_controller` failed to enforce strict administrator-only permission checks. This allowed users with the 'participant manager' role to render and mutate `Decidim::Verifications::CsvDatum` objects. Specifically, the `index`, `destroy`, `new_import`, `new_record`, `create_record`, `edit_record`, and `update_record` actions lacked the necessary `enforce_permission_to` calls. This has been patched in versions 0.30.9, 0.31.5, and 0.32.0 by adding explicit authorization guards to the affected controllers.

Affected products

Decidim decidim-verifications < 0.30.9, >= 0.31.0.rc1, < 0.31.5, >= 0.32.0.rc1, < 0.32.0

Identifiers

CVE-2026-45415
GHSA-q79h-67vx-m9xg

Timeline

2026-04-29: disclosed: Initial pull request for fix submitted
2026-05-10: patched: Final fix merged into develop branch
2026-07-13: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.