CVE-2026-45415

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1

Description Insufficient authorization enforcement in the record-management endpoints allows a participant manager to access and modify CSV census record admin forms. Specifically, the endpoint '/admin/csv census/census logs' does not require full administrator privileges before rendering or mutating Decidim::Verifications::CsvDatum. This allows users with participant manager roles to create, update, or delete census rows, which may lead to the corruption of verification data used in authorization workflows.

Recommendations Update to version 0.30.9. Update to version 0.31.5. Update to version 0.32.0.rc2. Disable the Organization Census verification method as a temporary workaround.