GHSA-639h-86hw-qcjqHighCVSS 7.1
Decidim has broken access control in templates
🔗 CVE IDs covered (1)
📋 Description
Impact
The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
🎯 Affected products4
- rubygems/decidim:>= 0.23.2, < 0.26.8
- rubygems/decidim-templates:>= 0.23.2, < 0.26.8
- rubygems/decidim-templates:>= 0.27.0, < 0.27.4
- rubygems/decidim:>= 0.27.0, < 0.27.4
🔗 References (7)
- https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
- https://github.com/decidim/decidim/releases/tag/v0.26.8
- https://github.com/decidim/decidim/releases/tag/v0.27.4
- https://nvd.nist.gov/vuln/detail/CVE-2023-36465
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-36465.yml
- https://github.com/advisories/GHSA-639h-86hw-qcjq