GHSA-639h-86hw-qcjq
Decidim has broken access control in templates
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | decidim | >= 0.23.2, < 0.26.8 | 0.26.8 |
| RubyGems | decidim-templates | >= 0.23.2, < 0.26.8 | 0.26.8 |
| RubyGems | decidim-templates | >= 0.27.0, < 0.27.4 | 0.27.4 |
| RubyGems | decidim | >= 0.27.0, < 0.27.4 | 0.27.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
- https://nvd.nist.gov/vuln/detail/CVE-2023-36465
- https://github.com/decidim/decidim
- https://github.com/decidim/decidim/releases/tag/v0.26.8
- https://github.com/decidim/decidim/releases/tag/v0.27.4
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-36465.yml