Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
decidim decidim affected
Version Status Constraints
>= 0.31.1, < 0.31.5 affected —
>= 0.32.0.rc1, < 0.32.0.rc2 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Decidim Subscribe
Decidim Subscribe

Project Subscriptions

Vendors Products
Decidim Subscribe
Decidim Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vq6j-hj8w-7v39 Decidim: Forms admin question editor lacks authorization
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/decidim/decidim/commit/fa52fb631a0788b30895d1312728a888607d81b5 cve-icon
https://github.com/decidim/decidim/commit/fc89301c6697c6101a7aed3fced3fa8311048cb9 cve-icon
https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39 cve-icon
History

Fri, 31 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Decidim
Decidim decidim
Vendors & Products Decidim
Decidim decidim

Fri, 31 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.
Title Decidim: Forms admin question editor lacks authorization
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-31T21:44:11.803Z

Reserved: 2026-05-08T19:27:26.697Z

Link: CVE-2026-45086

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T23:30:17Z

Weaknesses