CyberRota Analysis
AI-GeneratedThe Decidim participatory democracy framework is vulnerable in specific versions prior to 0.30.9, between 0.31.0 and 0.31.5, and in 0.32.0.rc1, where the /admin/csv_census/census_logs endpoints lack proper authorization checks. This flaw allows participant managers to create, modify, or delete census records without full administrative privileges, potentially compromising data integrity and trust in the system. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.