CVE-2026-45086
RubyGems · decidim-demographics
Summary
Decidim: Forms admin question editor lacks authorization
Advisory details
Description
A participant can load the demographics questionnaire admin editor and make changes.
Technical description
The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.
Reproduction steps:
Step 1. Sign in as a normal participant: Open http://localhost:3000/users/sign_in.
Step 2. Request the admin-only editor directly. Open http://localhost:3000/admin/demographics/questions/edit_questions in the same browser.
Step 3. Add another question:
Note that access was denied when attempting to see question responses or settings.
Impact
- Low-privilege users can access questionnaire-admin interfaces.
- They can read question-management surfaces that should remain limited to questionnaire managers.
Patches
See https://github.com/decidim/decidim/pull/16665
Workarounds
Disable the "decidim-demographics" module
Reference
OWASP A01:2021 Broken Access Control
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
References
Related advisories
- CVE-2026-111057 — critical · PyPI/mercury
- CVE-2026-105851 — critical · npm/payload
- CVE-2026-92957 — critical · npm/vm2
- CVE-2026-55536 — critical · PyPI/PraisonAI
- CVE-2026-64863 — critical · Go/goshs.de/goshs/v2
- CVE-2026-20896 — critical · Go/code.gitea.io/gitea
- CVE-2026-50006 — critical · Go/github.com/julien040/anyquery
- CVE-2026-50564 — critical · Go/github.com/fission/fission
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSummarize with AI
Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.