A high-severity authorization bypass vulnerability in Decidim allows authenticated attackers to access sensitive data, posing a significant risk to platform integrity.

This vulnerability involves an authorization bypass through user-controlled keys (CWE-639) and incorrect authorization (CWE-863). It requires an authenticated user with low privileges to manipulate identifiers to access unauthorized resources.

The potential for unauthorized access to sensitive participatory data can lead to data breaches and loss of public trust in the platform. Given the CVSS score of 8.5, this flaw represents a significant risk to the confidentiality of user information and administrative operations. Organizations relying on Decidim for democratic processes must treat this as a high-priority security concern.

Immediate Action: Administrators must update their Decidim installation to version 0.31.5 or 0.32.0.rc2 immediately to resolve the authorization logic flaws.

Proactive Monitoring: Review application access logs for unusual patterns, specifically attempts to access resource identifiers that do not belong to the currently authenticated user session.

Compensating Controls: While no direct WAF rule can perfectly mitigate logic flaws, implementing strict rate limiting on resource-heavy API endpoints may help deter automated exploitation attempts while the update is being staged.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized data exposure. Security teams should prioritize patching affected Decidim environments to the specified fixed versions to eliminate the risk of authorization manipulation by authenticated users.