Decidim vulnerable to possible CSRF attack at questionnaire templates preview
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure, Tampering
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918, CWE-352 and the CVSS impact.
Summary
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| decidim | decidim | 0.23.0 to before 0.27.5 | 0.27.5 | Patch available | CNA |
| — | decidim-templates (RubyGems) | 0.23.0 to before 0.27.5 | 0.27.5 | Patch available | GHSA-f3qm-vfc3-jg6v |
- decidim Vendordecidim Affected 0.23.0 to before 0.27.5 Fixed in 0.27.5 Patch available CNA
- decidim-templates (RubyGems) Vendor— Affected 0.23.0 to before 0.27.5 Fixed in 0.27.5 Patch available GHSA-f3qm-vfc3-jg6v
Remediation
- Fix · CNA decidim (decidim) Fixed in 0.27.5
- Fix · GHSA-f3qm-vfc3-jg6v decidim-templates (RubyGems) Fixed in 0.27.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47635
- 2026-10-03 Alias added: GHSA-f3qm-vfc3-jg6v
References
Patch 3
Other 6
- https://github.com/decidim/decidim/pull/11743
- https://github.com/decidim/decidim/pull/6247
- https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11
- https://github.com/decidim/decidim/releases/tag/v0.27.5
- https://github.com/decidim/decidim/releases/tag/v0.28.0
- https://github.com/decidim/decidim
More Decidim vulnerabilities
- TI-2025-40203 Decidim's private data exports can lead to data leaks CVSS 4.0HIGH 8.2
- TI-2023-16936 Decidim vulnerable to sensitive data disclosure CVSS 3.1HIGH 7.5
- TI-2026-19249 Decidim has a Cross-site scripting (XSS) vulnerability via user name field CVSS 4.0CRITICAL 9.3
- TI-2023-18306 Decidim has broken access control in templates CVSS 3.1CRITICAL 9.1
- TI-2023-16935 Decidim Cross-site Scripting vulnerability in the processes filter CVSS 3.1HIGH 8.1
- TI-2023-15969 Decidim Cross-site Scripting vulnerability in the external link redirections CVSS 3.1HIGH 8.1
Sources
- CVE-2023-47635 · CVE Program
- CVE-2023-47635 · NVD
- FIRST EPSS
- GHSA-f3qm-vfc3-jg6v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences