CVE-2026-45086

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45086
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45086.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45086
Aliases
Published
2026-07-31T21:44:11.803Z
Modified
2026-08-02T03:47:36.947146797Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Decidim: Forms admin question editor lacks authorization
Details

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45086.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
0a9443ed804ee6274fab904878bc0103af1c0f69
Fixed
03d80881ac459127f0e11999c8a733cf78e78736
Introduced
1f92fc97fd7186639617ce1b2ca53b6cbecb1eb8
Fixed
867174012910ba4f5f020a27444d47309fd19122
Fixed
fa52fb631a0788b30895d1312728a888607d81b5
Fixed
fc89301c6697c6101a7aed3fced3fa8311048cb9
Database specific 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.31.1"
        },
        {
            "fixed": "0.31.5"
        },
        {
            "introduced": "0.32.0.rc1"
        },
        {
            "fixed": "0.32.0.rc2"
        }
    ]
}

Affected versions

v0.*
v0.31.1
v0.31.2
v0.31.3
v0.31.4
v0.32.0.rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45086.json"