CVE-2026-45415 decidim CVE debrief

Who should care

Decidim administrators, users with participant manager roles, and those responsible for maintaining or securing Decidim installations should assess their exposure and prioritize verification and patching.

Why it matters

Decidim administrators and users should be aware of this vulnerability and take action to verify and patch their installations to prevent potential unauthorized modifications to census records.

• Potential unauthorized modification of census records by participant managers.
• Possible data integrity issues due to lack of authorization checks.
• Need for verification of Decidim installation versions and exposure.
• Prioritization of patching to prevent potential exploitation.

Technical summary

The /admin/csv_census/census_logs record-management endpoints in Decidim did not enforce full administrator authorization, allowing participant managers to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. The vulnerability could lead to potential unauthorized modifications to census records, data integrity issues, and exploitation by malicious actors. Decidim administrators and users should assess their exposure and prioritize verification and patching to prevent potential exploitation.

Defensive priority

Decidim administrators and users should assess exposure and prioritize verification of their installations, especially those with participant managers, to ensure they are running a patched version.

Recommended defensive actions

• Verify and apply patches to ensure Decidim installations are running versions 0.30.9, 0.31.5, or 0.32.0.rc2 or later.
• Review and restrict permissions for participant managers to prevent unauthorized census record modifications.
• Monitor Decidim installations for suspicious activity related to census logs.
• Perform a thorough review of Decidim installation configurations to ensure proper authorization checks are in place.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct a security audit to identify and address any existing vulnerabilities in Decidim installations.
• Develop and deploy custom compensating controls to mitigate potential risks associated with the vulnerability.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected versions. However, the scope of affected deployments and the exact number of impacted users require further verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.