critical9.1
CVE-2023-36465
Decidim has broken access control in templates
Impact
### Impact The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | decidim | >= 0.23.2, < 0.26.8 | 0.26.8 |
| rubygems | decidim-templates | >= 0.23.2, < 0.26.8 | 0.26.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Decidim | Decidim | before 0.26.8 from 0.27.0 before 0.27.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/decidim/decidim/releases/tag/v0.26.8
- https://github.com/decidim/decidim/releases/tag/v0.27.4
- https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
- https://github.com/advisories/GHSA-639h-86hw-qcjq
- https://nvd.nist.gov/vuln/detail/CVE-2023-36465
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-36465.yml