CVE-2023-36465

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.26.8 Decidim versions prior to 0.27.4

Description Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access this functionality in the administration panel. An attacker could use this issue to change, create, or delete templates of surveys.

Recommendations For Decidim versions prior to 0.26.8, update to version 0.26.8 or later to resolve the issue. For Decidim versions prior to 0.27.4, update to version 0.27.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the templates module in the administration panel to minimize the risk of exploitation.