CVE-2026-45415: 
Ruby vulnerability analysis and mitigation

CVE-2026-45415 is an improper authorization vulnerability in Decidim's decidim-verifications gem that allows a participant manager (a limited admin role) to access and manipulate CSV census record admin forms that should be restricted to full administrators. The vulnerability affects decidim-verifications versions prior to 0.30.9, versions 0.31.0.rc1 through 0.31.5, and versions 0.32.0.rc1 through 0.32.0. It was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, and was publicly disclosed on July 13, 2026. It carries a CVSS v3.1 base score of 6.0 (Moderate) (GitHub Advisory, Decidim Advisory).

The root cause is CWE-285 (Improper Authorization): the CSV census admin record-management surface under /admin/csv_census/census_logs fails to enforce admin-only authorization checks before rendering or mutating Decidim::Verifications::CsvDatum objects. Specifically, the index, destroy, new_import, create_import, new_record, create_record, edit_record, and update_record controller actions were missing enforce_permission_to calls, allowing any participant manager role to reach these endpoints over the network with no additional complexity. The fix, implemented in pull requests #16674 and #16703, inserts explicit enforce_permission_to guards into each affected action. This vulnerability is classified under OWASP A01:2021 Broken Access Control (GitHub Advisory, PR #16674, PR #16703).

A participant manager — an account with limited administrative privileges scoped to managing participants — can create, modify, or delete CSV census rows that underpin the Organization Census verification workflow. This corruption of Decidim::Verifications::CsvDatum records can invalidate or falsify the authorization data used to verify participant eligibility, potentially allowing unauthorized users to gain verified status or stripping legitimate users of their verification. The confidentiality impact is low (census data is exposed to the participant manager), the integrity impact is high (census records can be arbitrarily altered), and the availability impact is low (GitHub Advisory, Decidim Advisory).

Exploitation requires an authenticated session with participant manager privileges (high privileges required), but no user interaction or special conditions beyond that. There is no public proof-of-concept exploit code, no known in-the-wild exploitation, and no threat actor attribution at this time. The CVE status remains "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score is currently published (GitHub Advisory).

1. Obtain participant manager credentials: Acquire or compromise an account that holds the participant manager role on a target Decidim instance (this role can manage participants but is not a full administrator).
2. Authenticate to the admin panel: Log in to the Decidim admin interface at /users/sign_in using the participant manager account.
3. Navigate to the vulnerable endpoint: Directly browse to /admin/csv_census/census_logs/new_record (or other census endpoints such as /admin/csv_census/census_logs) — the form will render without triggering an authorization error on unpatched versions.
4. Manipulate census data: Use the exposed admin forms to create new CSV census rows, modify existing entries in Decidim::Verifications::CsvDatum, or delete rows to corrupt the verification dataset.
5. Abuse corrupted verification data: Leverage the tampered census records to grant unauthorized participants verified status within the Organization Census authorization workflow, or to revoke verification from legitimate participants (GitHub Advisory, Decidim Advisory).

• Logs: Web server or Rails application logs showing a participant manager session (non-full-admin user) making GET or POST requests to /admin/csv_census/census_logs, /admin/csv_census/census_logs/new_record, /admin/csv_census/census_logs/new_import, or individual record endpoints (/admin/csv_census/census_logs/:id/edit_record) — especially if these requests result in HTTP 200 responses rather than redirects.
• Database: Unexpected creation, modification, or deletion of Decidim::Verifications::CsvDatum records not attributable to a full administrator account; audit log entries (if enabled) showing census data changes by a participant manager user.
• Application Audit Trail: Decidim audit log entries recording census record mutations (create, update, destroy on CsvDatum) performed by accounts with the participant manager role rather than a full admin role.

Upgrade decidim-verifications to one of the patched versions: 0.30.9, 0.31.5, or 0.32.0. These releases add enforce_permission_to authorization checks to all affected CSV census controller actions. As an immediate workaround for organizations unable to upgrade, disable the Organization Census verification method in the Decidim admin settings to remove the vulnerable surface entirely (GitHub Advisory, PR #16674, PR #16703).

The vulnerability was discovered through a formal security audit organized by the Decidim Association and performed by Radically Open Security, funded by NGI, indicating a proactive security posture by the project maintainers. The advisory was published by core maintainer andreslucena and the fix was reviewed and merged promptly. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and associated pull requests (GitHub Advisory, Decidim Advisory).