GHSA-vq6j-hj8w-7v39

Suggest an improvement
Source
https://github.com/advisories/GHSA-vq6j-hj8w-7v39
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vq6j-hj8w-7v39/GHSA-vq6j-hj8w-7v39.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vq6j-hj8w-7v39
Aliases
Published
2026-07-13T16:51:05Z
Modified
2026-07-13T17:11:53Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Decidim: Forms admin question editor lacks authorization
Details

Description

A participant can load the demographics questionnaire admin editor and make changes.

Technical description

The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable.

Reproduction steps:

Step 1. Sign in as a normal participant: Open http://localhost:3000/users/sign_in. Step 2. Request the admin-only editor directly. Open http://localhost:3000/admin/demographics/questions/edit_questions in the same browser. Step 3. Add another question:

decidim-questions-01

Note that access was denied when attempting to see question responses or settings.

Impact

  • Low-privilege users can access questionnaire-admin interfaces.
  • They can read question-management surfaces that should remain limited to questionnaire managers.

Patches

See https://github.com/decidim/decidim/pull/16665

Workarounds

Disable the "decidim-demographics" module

Reference

OWASP A01:2021 Broken Access Control

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Database specific 
{
    "cwe_ids":  [
        "CWE-284"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-13T16:51:05Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / decidim-demographics

Package

Name
decidim-demographics
Purl
pkg:gem/decidim-demographics

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.31.0
Fixed
0.31.5

Affected versions

0.*
0.31.0
0.31.1
0.31.2
0.31.3
0.31.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vq6j-hj8w-7v39/GHSA-vq6j-hj8w-7v39.json"

RubyGems / decidim-demographics

Package

Name
decidim-demographics
Purl
pkg:gem/decidim-demographics

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.32.0.rc1
Fixed
0.32.0

Affected versions

0.*
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vq6j-hj8w-7v39/GHSA-vq6j-hj8w-7v39.json"