CVE-2026-45376
Decidim: Admin user search allows SQL injection through similarity-based sorting
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
| CWE | CWE-89 |
| Vendor | decidim |
| Product | decidim |
| Published | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for decidim decidim
Be the first to know when new medium vulnerabilities affecting decidim decidim are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low
Affected Versions
decidim / decidim
< 0.30.9 >= 0.31.0.rc1, < 0.31.5 >= 0.32.0.rc1, < 0.32.0
References
github.com: https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37 github.com: https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0 github.com: https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240 github.com: https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124 github.com: https://github.com/decidim/decidim/releases/tag/v0.30.9 github.com: https://github.com/decidim/decidim/releases/tag/v0.31.5 github.com: https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2