## Description A participant can load the demographics questionnaire admin editor and make changes. ## Technical description The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. Reproduction steps: Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question: <img width="1522" height="1174" alt="decidim-questions-01" src="https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8" /> Note that access was denied when attempting to see question responses or settings. ### Impact - Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches See https://github.com/decidim/decidim/pull/16665 ### Workarounds Disable the "decidim-demographics" module ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
## Description A participant can load the demographics questionnaire admin editor and make changes. ## Technical description The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. Reproduction steps: Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question: <img width="1522" height="1174" alt="decidim-questions-01" src="https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8" /> Note that access was denied when attempting to see question responses or settings. ### Impact - Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches See https://github.com/decidim/decidim/pull/16665 ### Workarounds Disable the "decidim-demographics" module ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
Update decidim-demographics to 0.31.5; decidim-demographics to 0.32.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDecidim: Forms admin question editor lacks authorization affects decidim-demographics (rubygems), decidim-demographics (rubygems). Severity is medium. ## Description A participant can load the demographics questionnaire admin editor and make changes. ## Technical description The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. Reproduction steps: Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question: <img width="1522" height="1174" alt="decidim-questions-01" src="https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8" /> Note that access was denied when attempting to see question responses or settings. ### Impact - Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches See https://github.com/decidim/decidim/pull/16665 ### Workarounds Disable the "decidim-demographics" module ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
AI coding agents often install or upgrade packages automatically in rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| decidim-demographicsrubygems | >=0.31.0,<0.31.5 | 0.31.5 |
| decidim-demographicsrubygems | >=0.32.0.rc1,<0.32.0 | 0.32.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate decidim-demographics to 0.31.5; decidim-demographics to 0.32.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDecidim: Forms admin question editor lacks authorization affects decidim-demographics (rubygems), decidim-demographics (rubygems). Severity is medium. ## Description A participant can load the demographics questionnaire admin editor and make changes. ## Technical description The demographics questionnaire editor should require admin access, but the route under `/admin/demographics/questions` renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. Reproduction steps: Step 1. Sign in as a normal participant: Open `http://localhost:3000/users/sign_in`. Step 2. Request the admin-only editor directly. Open `http://localhost:3000/admin/demographics/questions/edit_questions` in the same browser. Step 3. Add another question: <img width="1522" height="1174" alt="decidim-questions-01" src="https://github.com/user-attachments/assets/923f85d4-0e2f-4511-a9f3-a92f74dbf1d8" /> Note that access was denied when attempting to see question responses or settings. ### Impact - Low-privilege users can access questionnaire-admin interfaces. - They can read question-management surfaces that should remain limited to questionnaire managers. ### Patches See https://github.com/decidim/decidim/pull/16665 ### Workarounds Disable the "decidim-demographics" module ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
AI coding agents often install or upgrade packages automatically in rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| decidim-demographicsrubygems | >=0.31.0,<0.31.5 | 0.31.5 |
| decidim-demographicsrubygems | >=0.32.0.rc1,<0.32.0 | 0.32.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard