CVE-2026-45086: Decidim Auth Bypass Vulnerability

CVE-2026-45086 Overview

CVE-2026-45086 is a missing authorization vulnerability [CWE-862] in Decidim, an open-source participatory democracy framework. The flaw allows authenticated participants to reach the demographics questionnaire editor at /admin/demographics/questions/edit_questions without administrator privileges. The route renders the editor interface and its live update form action to any signed-in user because the controller does not verify admin access. Affected versions include 0.31.1 through 0.31.4 and 0.32.0.rc1. Fixes are available in 0.31.5 and 0.32.0.rc2.

Critical Impact
A low-privileged participant can access an administrative questionnaire editor, exposing protected configuration surface and enabling unauthorized modification of demographics questions.

Affected Products

Decidim 0.31.1 through 0.31.4
Decidim 0.32.0.rc1
Decidim participatory democracy framework (decidim-demographics, decidim-forms modules)

Discovery Timeline

2026-07-31 - CVE-2026-45086 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-45086

Vulnerability Analysis

The vulnerability resides in the Decidim::Demographics::Admin::QuestionsController, which includes the shared HasQuestionnaire concern from decidim-forms. The concern's edit and update actions call enforce_permission_to(:update, :questionnaire, ...), a permission subject that resolves in a context not scoped to the demographics admin namespace. As a result, the framework's authorization layer does not require the administrator role for the demographics questionnaire editor. A normal participant issuing a GET request to /admin/demographics/questions/edit_questions receives the rendered editor template, including the live update form action that targets the protected endpoint.

Root Cause

The root cause is an incorrect permission subject in the shared questionnaire concern. enforce_permission_to(:update, :questionnaire, ...) was invoked with a generic subject that does not map to a demographics-admin authorization rule. Because no permission policy denies non-admin participants for that subject in this route, the check effectively passes. The controller lacked its own permission_subject override to identify the request as a demographics-admin action.

Attack Vector

Exploitation requires a network path to the Decidim instance and a low-privileged participant account. No user interaction beyond navigating to the admin URL is required. The attacker authenticates as a participant, requests /admin/demographics/questions/edit_questions, and receives the editor page. From there, the exposed form action can be used to attempt modification of the demographics questionnaire.

ruby

# Patch: decidim-demographics/app/controllers/decidim/demographics/admin/questions_controller.rb
        include Decidim::Forms::Admin::Concerns::HasQuestionnaire
        include Decidim::Forms::Admin::Concerns::HasQuestionnaireResponsesUrlHelper

+       def permission_subject = :demographics
+
        def edit_questions_template = "decidim/demographics/admin/questions/edit"

        def after_update_url = edit_questions_questions_path
# Source: https://github.com/decidim/decidim/commit/fa52fb631a0788b30895d1312728a888607d81b5

ruby

# Patch: decidim-forms/app/controllers/decidim/forms/admin/concerns/has_questionnaire.rb
            def edit
-             enforce_permission_to(:update, :questionnaire, questionnaire:)
+             enforce_permission_to(:update, permission_subject, questionnaire:)

              @form = form(Admin::QuestionnaireForm).from_model(questionnaire)
              render template: edit_template
            end

            def update
-             enforce_permission_to(:update, :questionnaire, questionnaire:)
+             enforce_permission_to(:update, permission_subject, questionnaire:)

              @form = form(Admin::QuestionnaireForm).from_params(params)
# Source: https://github.com/decidim/decidim/commit/fc89301c6697c6101a7aed3fced3fa8311048cb9

The fix introduces a controller-level permission_subject (:demographics) and refactors the concern to enforce permissions against that dynamic subject, ensuring the demographics-admin authorization rule is evaluated.

Detection Methods for CVE-2026-45086

Indicators of Compromise

Non-admin session identifiers appearing in HTTP access logs for /admin/demographics/questions/edit_questions.
HTTP 200 responses returned from /admin/demographics/questions routes to accounts lacking the administrator role.
Unexpected POST or PATCH requests to demographics questionnaire update endpoints originating from participant-tier users.

Detection Strategies

Review Rails production logs and reverse-proxy access logs for requests to /admin/demographics/questions/* and correlate the requesting user identifier against the administrator user set.
Compare deployed Decidim versions against fixed releases (0.31.5, 0.32.0.rc2) using package manifests such as Gemfile.lock.
Add an audit query that flags any authenticated non-admin session that received a 2xx response from an /admin/* route.

Monitoring Recommendations

Enable and retain HTTP access logging with the authenticated user identifier for all /admin routes.
Alert on modifications to demographics questionnaire records where the actor is not a confirmed administrator.
Continuously monitor GitHub Security Advisories for the Decidim GHSA-vq6j-hj8w-7v39 advisory and downstream package feeds.

How to Mitigate CVE-2026-45086

Immediate Actions Required

Upgrade Decidim to 0.31.5 for the 0.31.x branch or 0.32.0.rc2 for the 0.32 pre-release branch.
Audit access logs for prior requests to /admin/demographics/questions/edit_questions from non-admin accounts and review any demographics questionnaire changes.
Restrict /admin paths at the reverse-proxy layer to source IP ranges used by administrators until the patch is deployed.

Patch Information

The fixes are delivered in two upstream commits: commit fa52fb6 (v0.31 backport) and commit fc89301 (v0.32 backport). Both add a permission_subject = :demographics override in the demographics QuestionsController and update the HasQuestionnaire concern to enforce permissions using that subject. Full details are documented in the GitHub Security Advisory GHSA-vq6j-hj8w-7v39.

Workarounds

Block the /admin/demographics/questions route at the web server or reverse proxy for any request whose session cookie does not belong to an administrator account.
Temporarily disable the decidim-demographics module in Gemfile if it is not required for production operation.
Enforce network-level restrictions on /admin routes using an allowlist of administrator IP addresses.

bash

# Example nginx snippet restricting the vulnerable route until patched
location ~ ^/admin/demographics/questions {
    allow 10.0.0.0/24;   # administrator subnet
    deny  all;
    proxy_pass http://decidim_upstream;
}