CVE-2026-45415: 
Ruby 脆弱性分析と緩和策

CVE-2026-45415 is an improper authorization vulnerability in Decidim, an open-source participatory democracy framework, affecting the CSV census record management endpoints. The flaw allows a participant manager — a privileged but non-administrator role — to access, create, modify, or delete Decidim::Verifications::CsvDatum records via the /admin/csv_census/census_logs admin surface without full administrator authorization. Affected versions include all releases prior to 0.30.9, 0.31.0.rc1 through 0.31.5, and 0.32.0.rc1 through 0.32.0.rc2. The vulnerability was published on July 13, 2026, and carries a CVSS v3.1 base score of 6.0 (Moderate) (Github Advisory, Decidim Advisory).

The root cause is a missing authorization enforcement (CWE-285: Improper Authorization; CWE-862: Missing Authorization) in the Decidim::Verifications::CsvCensus::Admin::CensusController and CensusRecordsController. Specifically, the index, destroy, new_import, create_import, new_record, create_record, edit_record, and update_record actions lacked enforce_permission_to calls, meaning the controller did not verify that the authenticated session held full administrator privileges before rendering forms or mutating census data. An attacker with a participant manager account can directly navigate to endpoints such as /admin/csv_census/census_logs/new_record and interact with the forms without being a full admin. The fix, implemented in PRs #16674 and #16703, adds explicit enforce_permission_to guards to all affected actions (Decidim Advisory, PR #16674, PR #16703).

Successful exploitation allows any participant manager to corrupt the CSV census verification data that authorization workflows depend upon — they can insert fraudulent census rows, alter existing entries to grant or revoke participant verification status, or delete records entirely. This undermines the integrity of the Organization Census verification method, potentially allowing unauthorized participants to gain verified status or legitimate participants to lose it. Confidentiality impact is low (limited read access to census data), while integrity impact is high and availability impact is low (Github Advisory, Decidim Advisory).

The vulnerability requires the attacker to already hold a participant manager account (high privileges required), making opportunistic exploitation less likely. The EPSS score is approximately 0.396% (33rd percentile), and the NVD SSVC assessment classifies exploitation as "poc" with the exploit not being automatable and technical impact as partial. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Obtain participant manager credentials: Acquire or compromise an account with participant manager privileges on a vulnerable Decidim instance (versions < 0.30.9, 0.31.0.rc1–0.31.5, or 0.32.0.rc1–0.32.0.rc2).
2. Authenticate to the admin panel: Log in to the Decidim admin interface using the participant manager account.
3. Navigate to the vulnerable endpoint: Directly browse to /admin/csv_census/census_logs/new_record (or other census management endpoints such as /admin/csv_census/census_logs) — the form will load without triggering an authorization error.
4. Manipulate census records: Use the exposed admin forms to create new CSV census rows, modify existing entries (e.g., altering participant verification eligibility), or delete records by submitting DELETE requests to /admin/csv_census/census_logs/:id.
5. Achieve objective: Corrupt verification data to grant unauthorized participants verified status, revoke legitimate participants' verification, or disrupt authorization workflows relying on census data (Decidim Advisory, PR #16674).

• Logs: Web server or application logs showing a participant manager session (non-full-admin user) accessing /admin/csv_census/census_logs, /admin/csv_census/census_logs/new_record, /admin/csv_census/census_logs/new_import, or similar census management endpoints.
• Logs: Unexpected POST, PATCH, or DELETE requests to /admin/csv_census/census_logs/* originating from participant manager accounts rather than full administrator accounts.
• Application Data: Unexplained creation, modification, or deletion of Decidim::Verifications::CsvDatum records not correlated with legitimate administrator activity.
• Application Data: Changes to CSV census verification data that affect participant authorization status without corresponding administrator audit trail entries.

Upgrade to one of the patched versions: 0.30.9, 0.31.5, or 0.32.0 (stable release). For installations that cannot be immediately upgraded, the recommended workaround is to disable the Organization Census verification method in the Decidim admin settings, which removes the vulnerable attack surface. The fixes were implemented by adding enforce_permission_to authorization checks to all affected controller actions in the decidim-verifications gem (Decidim Advisory, PR #16674, PR #16703).

The vulnerability was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, funded by NGI. The advisory credits this responsible disclosure process and references OWASP A01:2021 (Broken Access Control). No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory (Decidim Advisory).