115847 matches found
Decidim: CSV census record endpoints improper authorization
Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through improper authorization checks in the csvcensus admin endpoints. An attacker can access and modify sensitive census records by directly interacting with admin forms, potentially corrupting verification data...
GHSA-R3V7-5X4C-C69Q Decidim: JWT-backed authentication can be replayed across organizations
Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...
Decidim: JWT-backed authentication can be replayed across organizations
Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...
Decidim: Verification documents can be downloaded through reusable links
Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...
Decidim: Admin user search allows SQL injection through similarity-based sorting
The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression. Technical description The vulnerable...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params:term is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params:term is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions...
GHSA-86FH-W43W-338C Decidim: Verification admins can access supplied IDs from other organizations
Description The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant. Technical description The verification admin controllers loads pendingauthorizationid with a raw Authorization.find... and then authorizes the record without...
Decidim: Forms admin question editor lacks authorization
Description A participant can load the demographics questionnaire admin editor and make changes. Technical description The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the...
GHSA-VQ6J-HJ8W-7V39 Decidim: Forms admin question editor lacks authorization
Description A participant can load the demographics questionnaire admin editor and make changes. Technical description The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
SummaryA vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's acce...
PYSEC-2026-2713 Open WebUI allows limited stored XSS vila uploaded html file
Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...