CVE-2023-36465

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-36465
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36465.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-36465
Aliases
Published
2023-10-06T11:56:46.825Z
Modified
2025-12-20T02:53:03.856761Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator
Summary
Decidim has broken access control in templates
Details

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36465.json",
    "cwe_ids": [
        "CWE-284"
    ]
}
References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
3041983cf585fb7487891f880c73064eebf2e2f3
Fixed
08f4b9f6e973590626ebbdd16abfbb7f64667104
Database specific 
{
    "versions": [
        {
            "introduced": "0.23.2"
        },
        {
            "fixed": "0.26.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
fcac16c9eed35c9ca0ac30a3be7b962881aa06ee
Fixed
83be368eb17d4a1b77512dbb59ed2bff04e40246
Database specific 
{
    "versions": [
        {
            "introduced": "0.27.0"
        },
        {
            "fixed": "0.27.4"
        }
    ]
}

Affected versions

v0.*

v0.27.0
v0.27.1
v0.27.2
v0.27.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36465.json"