Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum. A participant manager (which can only manage participants) can therefore open the admin forms, create or update census rows, and delete rows directly. Reproduction steps: 1. Sign in a participant admin and open http://localhost:3000/admin/csvcensus/censuslogs/newrecord in the browser. Confirm the create form loads even though the session is not a full admin. <img width="1541" height="274" alt="decidim-census-01" src="https://github.com/user-attachments/assets/859ee101-746f-4acb-8051-27036689f1b3" / <img width="1538" height="363" alt="decidim-census-02" src="https://github.com/user-attachments/assets/85bbb004-a999-46dc-856c-fd32b50ced2c" / Note that normal participant accounts were not able…
Recommended action: Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until the signature expires. Technical description This issue comes from the verification admin UI exposing scanned documents through reusable Active Storage disk links. Verification-document images are rendered with varianturl(...), which produces signed /rails/activestorage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verificationattachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views.…
Recommended action: Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The verification admin mutation flow allows accessing, verifying, and rejecting participants records from another tenant. Technical description The verification admin controllers loads pendingauthorizationid with a raw Authorization.find(...) and then authorizes the record without checking whether it belongs to currentorganization. Reproduction steps: 1. An org2 participant uploads their ID: <img width="2184" height="1288" alt="decidim-verification-01" src="https://github.com/user-attachments/assets/c6713454-c787-4795-b852-3c2c672358d6" / 2. An admin from another organisation, in this case org1, is able to open the ID from org2 by opening request 35, e.g http://localhost:3001/admin/iddocuments/pendingauthorizations/35/confirmations/new <img width="1539" height="1037" alt="decidim-verification-02" src="https://github.com/user-attachments/assets/6ed646de-a501-4964-8467-013ada55ce2d" / 3. The admin then approves this request by looking up the ID in the picture (not shown in…
Recommended action: Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.