CVE-2026-45086: 
Ruby vulnerability analysis and mitigation

CVE-2026-45086 is a broken access control vulnerability in the decidim-demographics module of the Decidim participatory democracy platform, where the demographics questionnaire admin editor is accessible to any authenticated participant without admin authorization checks. The affected route /admin/demographics/questions/edit_questions renders the admin editor interface without verifying whether the caller holds admin privileges. Affected versions are decidim-demographics >= 0.31.0 and < 0.31.5, and >= 0.32.0.rc1 and < 0.32.0. The vulnerability was discovered through a security audit organized by the Decidim Association and conducted by Radically Open Security, and was publicly disclosed on July 13, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Decidim Advisory).

The root cause is improper access control (CWE-284), classified under OWASP A01:2021 Broken Access Control. The decidim-demographics module's questions_controller and the has_questionnaire concern in decidim-forms failed to call enforce_permission_to before rendering the edit_questions and update_questions actions, meaning the admin route was reachable by any authenticated user. The fix, implemented in pull request #16665, adds explicit permission_subject methods and enforces permission checks on these actions, ensuring only users with admin-level access can reach the questionnaire editor (GitHub PR #16665, GitHub Advisory).

A low-privilege authenticated participant can access the demographics questionnaire admin editor interface, view question-management surfaces restricted to questionnaire managers, and potentially add or modify questionnaire questions. The confidentiality and integrity impacts are both low — the attacker can read admin-only UI surfaces and submit form actions, but access to question responses and settings was denied in testing. There is no availability impact, and the vulnerability scope is unchanged, limiting blast radius to the demographics questionnaire management functionality (GitHub Advisory, Decidim Advisory).

1. Obtain a participant account: Register or log in as a normal (non-admin) participant at http://<target>/users/sign_in.
2. Navigate directly to the admin editor: In the same authenticated browser session, visit http://<target>/admin/demographics/questions/edit_questions — the route does not check for admin privileges and renders the editor interface.
3. Interact with the admin interface: Use the live update form action presented on the page to add, modify, or view questionnaire questions that should be restricted to questionnaire managers.
4. Observe access boundaries: Note that routes for viewing question responses or settings may still return access-denied errors, limiting the scope of unauthorized actions to question management (GitHub Advisory, Decidim Advisory).

• Network: Authenticated HTTP GET or POST requests to /admin/demographics/questions/edit_questions or /admin/demographics/questions originating from non-admin user sessions.
• Logs: Web server or application logs showing participant-level user accounts (non-admin roles) accessing /admin/demographics/questions endpoints, particularly edit_questions or update_questions actions.
• Application Behavior: Unexpected changes to demographics questionnaire questions (additions, modifications) not attributable to known admin accounts.

Upgrade decidim-demographics to version 0.31.5 (for the 0.31.x branch) or 0.32.0 (for the 0.32.x branch), which include the fix from pull request #16665 that adds proper permission enforcement to the questionnaire admin actions. As a temporary workaround, disable the decidim-demographics module entirely until the upgrade can be applied. The fix also improves permission checks in related modules (decidim-forms, decidim-elections, decidim-meetings, decidim-surveys) for defense in depth (GitHub Advisory, GitHub PR #16665).

The vulnerability was discovered as part of a formal security audit organized by the Decidim Association and conducted by Radically Open Security, financed by NGI, indicating a proactive security posture by the project maintainers. The fix was reviewed and merged by the Decidim core team with automated code review from CodeRabbit, and backported to both the v0.31 and v0.32 release branches (GitHub PR #16665, Decidim Advisory). No significant broader media coverage or social media discussion has been identified.