CVE-2023-36465: Decidim has broken access control in templates

October 6, 2023 (updated October 11, 2023)

Impact

The templates module does not enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.

References

github.com/advisories/GHSA-639h-86hw-qcjq
github.com/decidim/decidim/releases/tag/v0.26.8
github.com/decidim/decidim/releases/tag/v0.27.4
github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq

Code Behaviors & Features

Detect and mitigate CVE-2023-36465 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →