CVE-2026-45086 decidim CVE debrief

Who should care

Administrators and users of Decidim versions 0.31.1 to 0.31.4 and 0.32.0.rc1 should be aware of this vulnerability and take necessary actions to secure their systems. This includes reviewing access controls, monitoring for unauthorized access attempts, and applying patches or updates to Decidim versions 0.31.5 or 0.32.0.rc2 or later. Additionally, operators, platform administrators, and security teams should review the vulnerability details and assess their exposure to ensure proper mitigation and remediation efforts are undertaken. Vulnerability management and security teams should prioritize patching to prevent potential unauthorized access and monitor for any suspicious activity related to the demographics questionnaire editor. Affected product deployments in managed environments should be confirmed and assigned an owner for follow-up to ensure timely remediation and minimize potential impact. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified to prevent exploitation. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review, and exceptions should be tracked, retested, and remediated with documented evidence before closing the item. Asset inventory and source tracking should also be considered to ensure comprehensive vulnerability management. Rollback change windows should be planned if necessary to minimize downtime during remediation. The demographics questionnaire editor access review and compensating controls implementation are crucial for preventing unauthorized modifications and ensuring the security of the system. Security teams should also consider the operational impact of this vulnerability and plan accordingly to minimize potential disruptions. The review context and source-confidence limits should be evaluated to ensure that the necessary measures are taken to address this vulnerability effectively. Overall, a coordinated effort is required to mitigate the risks associated with CVE-2026-45086 and ensure the security and integrity of Decidim systems. Security teams should work closely with operators, platform administrators, and other stakeholders to ensure a

Technical summary

CVE-2026-45086 is a MEDIUM severity vulnerability in Decidim, a participatory democracy framework. The issue allows participants to directly access the demographics questionnaire editor without administrator authorization in versions 0.31.1 to 0.31.4 and 0.32.0.rc1. This is due to a lack of authorization checks on the /admin/demographics/questions route, which renders the editor interface without verifying if the caller is an administrator. The vulnerability has a CVSS score of 5.4 and can lead to unauthorized modifications of the questionnaire.

Defensive priority

CVE-2026-45086 is rated MEDIUM with a CVSS score of 5.4. Administrators should prioritize patching to prevent potential unauthorized access.

Recommended defensive actions

• Apply patches or updates to Decidim versions 0.31.5 or 0.32.0.rc2 or later.
• Restrict access to the demographics questionnaire editor to authorized administrators.
• Monitor for unauthorized access attempts to the editor interface.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-45086 issue allows participants to access the demographics questionnaire editor without admin authorization in Decidim versions 0.31.1 to 0.31.4 and 0.32.0.rc1. This access could lead to unauthorized modifications. The issue is addressed in versions 0.31.5 and 0.32.0.rc2.

Official resources