This is a broken access control vulnerability in Decidim's admin interface for the demographics questionnaire module. Affected versions are 0.31.1 through 0.31.4 and 0.32.0.rc1. The fix is in 0.31.5 and 0.32.0.rc2. The vulnerability exists because a single authorize! call was missing from the controller that renders the demographics editor — the admin interface was fully functional for any user who guessed or discovered the URL, not merely leaking UI chrome. You need to update immediately if you're running any affected version.
The CVSS 5.4 rating badly understates the real risk. Decidim is a participatory democracy platform used by municipalities and organizations to run participatory budgeting, citizen assemblies, and binding votes. The demographics questionnaire determines whether a process is representative — corrupting this data doesn't just change form fields, it potentially launders an unrepresentative outcome as legitimate. If your Decidim instance was running an affected version during an active participatory process, you should treat your demographic data as potentially compromised and audit it against any independent records of participation demographics.
Beyond updating, audit your other admin routes. The fix location suggests this was an isolated omission, but the pattern — a route under /admin/ that relies on UI obscurity rather than authorization enforcement — has appeared repeatedly in Rails applications. Check that every admin controller action has explicit authorization checks, not just links in the navigation menu.
The EPSS score of 0.00171 is low because Decidim has a niche deployment footprint, not because the vulnerability is low-risk. Civic infrastructure is a high-value target precisely because compromising it can cast doubt on the legitimacy of governmental or organizational decisions. Treat this as a priority update regardless of what EPSS suggests.