CVE-2023-36465: Decidim has broken access control in templates

October 6, 2023 (updated October 11, 2023)

Impact

The templates module does not enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.

References

github.com/advisories/GHSA-639h-86hw-qcjq
github.com/decidim/decidim/releases/tag/v0.26.8
github.com/decidim/decidim/releases/tag/v0.27.4
github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq

Detect and mitigate CVE-2023-36465 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →