CVE-2023-36465

Executive Summary

CVE-2023-36465 is a broken access control vulnerability in the Decidim participatory democracy platform, a Ruby on Rails framework originally developed for the Barcelona City government. The templates module fails to enforce correct permission checks, allowing any authenticated (logged-in) user to access template management functionality in the administration panel. An attacker exploiting this flaw can create, modify, or delete survey templates, which are content blocks used across participation processes. The vulnerability carries a CVSS score of 9.1 (Critical), is not listed in CISA KEV, and has no public PoC. Organizations running Decidim versions prior to 0.26.8 and 0.27.4 are affected and should prioritize patching.

Technical Analysis

Decidim is a participatory democracy framework written in Ruby on Rails, designed to support citizen engagement through online and offline participation processes. The platform includes extensive administrative functionality, including survey templates that allow administrators to create reusable survey structures.

The vulnerability resides in the templates module — a feature set that, by design, should be restricted to users with administrative privileges over participation processes. Per the NVD description: "The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel."

Vulnerability Mechanism (class-level): This is a classic broken access control (BAC) flaw (CWE-284). The application fails to validate that the authenticated user possesses the required role or permission set before granting access to template management operations. In Ruby on Rails applications, such flaws typically occur when:

1. Controller-level authorization is missing — the application relies on route-level restriction (e.g., only rendering admin namespace routes) but fails to check user roles within the controller actions.
2. Missing authorize/allowed_to? checks — authorization frameworks like Pundit or CanCanCan are either not invoked or configured incorrectly for the templates controllers.
3. Inconsistent permissions — the permission system may check for one permission (e.g., :read) but allow write operations, or check permissions on the parent resource but not the nested templates module.

The attack surface is the administration panel — the authenticated web interface where privileged operations are performed. Because the authorization check is missing at the module level, any user with a valid session — regardless of their role (regular participant, collaborator, or unprivileged admin) — can invoke template mutation endpoints.

Impact Scope: The vulnerability permits three operations on templates: change (modify existing), create (add new), and delete (remove existing). Since survey templates are reused across multiple participation processes, a compromised template can propagate malicious or misleading survey content to a wide audience of citizens.

The NVD description does not provide specific endpoint paths, function names, or parameter details. Insufficient technical detail is available to describe the exact code-level flaw (e.g., which controller or which authorization framework is bypassed). The analysis above is at the vulnerability-class level.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

The exploitation chain for this broken access control flaw proceeds as follows:

Step 1 — Reconnaissance / Target Identification: An attacker first identifies a target Decidim instance — these are public-facing websites (e.g., city government participation portals). The attacker creates a standard user account through the public registration flow (typical for Decidim, which encourages citizen participation), or compromises an existing low-privileged account via credential stuffing or phishing. The target is any Decidim deployment running a version prior to 0.26.8 (for the 0.26.x branch) or 0.27.4 (for the 0.27.x branch).

Step 2 — Triggering the Flaw: Once authenticated, the attacker navigates to the administration panel. On a properly secured system, access to template management would require an administrative role. Due to the missing permission enforcement, the application grants access to the templates module regardless of the user's assigned role. The attacker reaches the template management interface through the standard administrative navigation — no special payload or injection is required. The flaw is triggered simply by requesting the template management endpoints while authenticated with a non-privileged account.

Step 3 — Payload / Execution Method (vulnerability-class level): The attack exploits the fact that the application fails to enforce a precondition (role/permission check) before executing template operations. The attacker uses the standard template CRUD interface to:

• Create new survey templates containing arbitrary content (e.g., phishing questions, social engineering lures).
• Modify existing survey templates to inject malicious or misleading survey questions.
• Delete legitimate templates, causing denial of service for administrative survey workflows.

In a real deployment, this could be compounded with stored XSS or other content injection if template content is rendered without proper sanitization — though the NVD description does not indicate whether such secondary vulnerabilities exist.

Step 4 — Post-Exploitation Impact: The attacker can manipulate survey content across the platform. Depending on how templates are used, altering a shared template could affect multiple active surveys simultaneously, causing a widespread integrity breach of the democratic participation process. The attacker could influence public opinion via planted survey questions, exfiltrate survey responses, or disrupt ongoing consultation processes. Because the vulnerability is in administrative functionality, the integrity impact is high, but the availability impact is limited to template operations (deletion).

Impact Assessment

CVSS Analysis: With a score of 9.1 (Critical), this vulnerability is rated for high confidentiality and high integrity impact, and low availability impact, with a scope change (meaning the compromised component affects resources beyond its security scope). The attack vector is network (remote), the attack complexity is low, low privileges are required, and no user interaction is needed.

Business Impact:

• Integrity: Attackers can tamper with survey templates, altering the questions citizens are asked. In a democracy platform, this directly undermines the legitimacy of public consultations.
• Confidentiality: While the NVD description does not explicitly mention data exfiltration, the ability to create surveys could be leveraged to extract information from respondents (e.g., crafting a phishing survey to collect personal data).
• Availability: Template deletion can break existing survey processes, halting official participation campaigns.
• Reputational Damage: A participatory democracy platform is a high-trust service. A compromise would erode public confidence in the institution running it (typically a government body).

Affected Systems: All Decidim deployments on the 0.26.x branch (before 0.26.8) and 0.27.x branch (before 0.27.4). The vulnerability affects Ruby on Rails applications using the templates module in the administration panel.

Blast Radius: Decidim is used by multiple European city governments (Barcelona, Helsinki, and others). A single compromised instance affects all active participation processes hosted on that instance. Due to the platform's public-facing nature, the number of potential victims (citizen participants) can be very large.

EPSS Context: The EPSS score of 0.00541 (42.6th percentile) indicates low immediate exploitation likelihood in the wild, but this reflects a lack of public PoC rather than the severity of the flaw. The privileged-but-low barrier to exploitation (any authenticated user) makes this an attractive target once discovered.

Detection Guidance

Sigma Rule

title: Decidim Templates Module Unauthorized Access
id: 4a1e6b1c-9f0d-4a5e-8b3c-7d5f6e2a1b9c
status: experimental
description: Detects access to Decidim templates administration functionality by non-admin users
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-36465
author: ValtersIT Threat Intelligence
date: 2024/01/15
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: decidim
    definition: 'Requires Decidim application logs with user role information'
detection:
    selection:
        module: 'templates'
        request_path|contains: '/admin/templates'
        user_role|contains: 
            - 'participant'
            - 'user'
            - 'collaborator'
    filter_known_admin:
        user_role|contains: 'admin'
    condition: selection and not filter_known_admin
level: high

YARA Rule

rule Decidim_Templates_Broken_Access_Control
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects CVE-2023-36465 exploitation artifacts — Decidim templates module access without admin permissions"
        cve = "CVE-2023-36465"
        date = "2024-01-15"
        severity = "critical"
    strings:
        $template_action = /[Cc]reate[ _]template|[Uu]pdate[ _]template|[Dd]elete[ _]template/ ascii
        $admin_path = /\/admin\/templates/ ascii
        $templates_controller = /TemplatesController/ ascii
        $template_params = /template\[\w+\]/ ascii
        $rbac_check = /authorize\s*\(?\s*:template/ ascii
        $permission_miss = /permission.*templates|templates.*permission/ ascii
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A // HTTP response or log line
        and any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-36465 Decidim Templates Unauthorized Access Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/admin/templates"; http_uri; content:"session"; http_cookie; content:"!admin"; http_cookie; reference:cve,2023-36465; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-36465; classtype:attempted-admin; sid:20240115; rev:1;)

Note: The Suricata rule above is a template that requires tuning to the specific deployment. The content:"!admin" match on cookies is a simplification — in practice, you would need to detect admin role indicators in session cookies or correlate with later HTTP requests showing non-admin accounts authoring template changes.

Elastic Detection

// Detects non-admin users accessing template management endpoints
sequence by user.id with maxspan=5m
  [authentication where event.action == "login" and user.roles != null and not contains(user.roles, "admin")]
  [network where process.name == "nginx" or process.name == "puma" or process.name == "passenger"
   and url.path like "*/admin/templates*"
   and http.request.method in ("GET", "POST", "PUT", "PATCH", "DELETE")]

Splunk SPL Query

index=nginx sourcetype=access_combined
| where like(uri_path, "%/admin/templates%")
| join type=inner user_id [search index=application sourcetype=decidim_auth
    | rename account_id as user_id, account_roles as user_roles]
| where NOT match(user_roles, "(?i)admin")
| table _time, src_ip, user_id, user_roles, uri_path, http_method, status
| sort - _time

Wazuh OSSEC Rule

<group name="decidim_access_control,">
  <rule id="100234" level="12">
    <decoded_as>nginx</decoded_as>
    <field name="url">\./admin/templates</field>
    <description>CVE-2023-36465: Non-admin user accessed Decidim templates module (possible broken access control exploitation)</description>
    <group>access_control,decidim,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100235" level="14">
    <if_sid>100234</if_sid>
    <field name="http_method">POST|PUT|PATCH|DELETE</field>
    <description>CVE-2023-36465: Non-admin user attempted template modification/deletion (exploitation confirmed)</description>
    <group>access_control,decidim,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description states that the issue "has been patched in version 0.26.8 and 0.27.4," but no patch sources were detected in the monitored channels. This likely indicates the patch was released by the vendor but not yet correlated in the intelligence feed — organizations should verify against the official Decidim release notes.

Immediate Mitigations (If Patching Not Immediately Possible):

1. Disable the templates module — If the deployment does not actively use survey templates, disable the feature at the application level or through feature flags.
2. Restrict admin panel access by network — Use IP allowlists or VPN requirements for /admin/* routes to limit who can reach the vulnerable functionality.
3. Enable and enforce role-based access control (RBAC) — If the Decidim instance supports custom permission policies, ensure that template management actions explicitly require an admin role.
4. Monitor authentication logs — Watch for low-privilege accounts accessing admin paths, especially /admin/templates.

Patch / Upgrade Steps:

1. Upgrade to patched version: Upgrade Decidim to version 0.26.8 (if on the 0.26.x branch) or 0.27.4 (if on the 0.27.x branch). Follow standard Decidim upgrade documentation: bundle update decidim, run database migrations (rails decidim:upgrade), and restart the application server.
2. Verify patch integrity: Confirm the upgrade via rails decidim:upgrade:status and check the version string in the admin panel.
3. If on an older branch (0.25.x or earlier): Upgrade to a patched release directly, but test thoroughly for compatibility.

Long-term Hardening:

1. Adopt a formal patching cadence — Subscribe to the Decidim security announcement channel and set a maximum patch turnaround time (e.g., 72 hours for critical CVEs).
2. Implement application-level authorization testing — Add automated tests that verify every admin panel route requires the appropriate role. This could include RSpec integration tests using the Decidim permission system.
3. Enable audit logging — Log all admin panel access, including which user performed template mutations, to enable forensic investigation.
4. Consider a web application firewall (WAF) — Deploy WAF rules to block admin path access from non-admin session indicators (though this is a partial mitigation given the vulnerability is in application logic, not network traffic).

References

1. NVD — CVE-2023-36465: https://nvd.nist.gov/vuln/detail/CVE-2023-36465
2. Decidim GitHub Security Advisories: https://github.com/decidim/decidim/security/advisories (check for advisory GHSA-xxxx-xxxx-xxxx related to CVE-2023-36465)
3. Decidim Release Notes (v0.27.4): https://github.com/decidim/decidim/releases/tag/v0.27.4 — verify patch confirmation and changelog
4. Decidim Release Notes (v0.26.8): https://github.com/decidim/decidim/releases/tag/v0.26.8 — verify patch confirmation and changelog
5. CISA KEV: Not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Threat Activity Note: As of this report, there are no known threat actor campaigns, no in-the-wild exploitation evidence, and no public exploit code associated with CVE-2023-36465. The EPSS score of 0.00541 reflects low immediate exploitation likelihood. However, broken access control vulnerabilities in government-facing platforms are high-value targets for hacktivist groups, APT actors, and cybercriminals seeking to undermine institutional trust. The absence of public exploit material should not be interpreted as the absence of private exploitation; SOC teams should remain vigilant for unusual administrative activity.