CVE-2023-36465.yml

---
gem: decidim-templates
cve: 2023-36465
ghsa: 639h-86hw-qcjq
url: https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
title: Decidim has broken access control in templates
date: 2023-10-05
description: |
  ### Impact

  The `templates` module doesn't enforce the correct permissions,
  allowing any logged-in user to access to this functionality in
  the administration panel. An attacker could use this vulnerability
  to change, create or delete templates of surveys.
cvss_v3: 9.1
unaffected_versions:
  - "< 0.23.2"
patched_versions:
  - "~> 0.26.8"
  - ">= 0.27.4"
related:
  url:
    - https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
    - https://github.com/decidim/decidim/releases/tag/v0.26.8
    - https://github.com/decidim/decidim/releases/tag/v0.27.4
    - https://github.com/advisories/GHSA-639h-86hw-qcjq
notes: "No NVD url; No cvss_v2"