A logged‑in participant may access the demographics questionnaire editor through the URL /admin/demographics/questions/edit_questions. The route does not verify administrator privileges, allowing the user to modify form questions and values that should be protected. The flaw is a missing authorization vulnerability (CWE‑862). This leads to unauthorized changes to civic engagement content, potentially compromising the integrity of surveys and damaging organizational trust.

The vulnerability affects Decidim framework versions from 0.31.1 up to but not including 0.31.5, and from 0.32.0.rc1 up to but not including 0.32.0.rc2. All deployments of these specific releases that expose the /admin/demographics/questions route are impacted.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must be a genuine, authenticated participant and must manually navigate to the specific URL; no remote code execution or elevated privileges beyond the participant role are required. The risk is therefore limited to unauthorized modification of questionnaire data rather than broader system compromise.