GHSA-Q79H-67VX-M9XG Decidim: CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...

Decidim - CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. Credits This issue was discovered in a security audit...

PT-2026-60072

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description Insufficient authorization enforcement in the record-management endpoints allows a participant manager to access and modify CSV cens...