## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
Update decidim-verifications to 0.30.9; decidim-verifications to 0.31.5; decidim-verifications to 0.32.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDecidim: CSV census record endpoints improper authorization affects decidim-verifications (rubygems), decidim-verifications (rubygems), decidim-verifications (rubygems). Severity is medium. ## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
AI coding agents often install or upgrade packages automatically in rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| decidim-verificationsrubygems | <0.30.9 | 0.30.9 |
| decidim-verificationsrubygems | >=0.31.0.rc1,<0.31.5 | 0.31.5 |
| decidim-verificationsrubygems | >=0.32.0.rc1,<0.32.0 | 0.32.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate decidim-verifications to 0.30.9; decidim-verifications to 0.31.5; decidim-verifications to 0.32.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDecidim: CSV census record endpoints improper authorization affects decidim-verifications (rubygems), decidim-verifications (rubygems), decidim-verifications (rubygems). Severity is medium. ## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description The CSV census admin record-management surface under `/admin/csv_census/census_logs` does not enforce admin-only authorization before rendering or mutating `Decidim::Verifications::CsvDatum`. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open `http://localhost:3000/admin/csv_census/census_logs/new_record` in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" /> <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" /> Note that normal participant accounts were not able to access the CSV census records which is good. ### Impact Any participant admin can create, alter, or remove CSV census rows, which can corrupt verification data relied on by authorization workflows. ### Patches See https://github.com/decidim/decidim/pull/16674 and https://github.com/decidim/decidim/pull/16703 ### Workarounds Disable Organization Census verification method ### Reference OWASP A01:2021 Broken Access Control ### Credits This issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).
AI coding agents often install or upgrade packages automatically in rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| decidim-verificationsrubygems | <0.30.9 | 0.30.9 |
| decidim-verificationsrubygems | >=0.31.0.rc1,<0.31.5 | 0.31.5 |
| decidim-verificationsrubygems | >=0.32.0.rc1,<0.32.0 | 0.32.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard