CVE-2023-36465

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-284 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364664.3Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic titl CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra CVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own use CVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing CVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6R CVE-2023-364725.7Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset pas CVE-2023-364736.1Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CVE-2023-364746.1Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 w CVE-2023-364759.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, a CVE-2023-364765.5calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensio