Threats tagged 'ghsa-q79h-67vx-m9xg'

Decidim's CSV census record admin endpoints lack proper authorization checks, allowing participant managers to access and modify census records. This improper access control enables participant managers, who should only manage participants, to create, update, or delete CSV census rows. The vulnerability affects Decidim versions prior to 0.30.9. The issue was identified as broken access control and has been addressed in patches referenced in Decidim's GitHub repository.