Junglewise Threat Intelligence

CVE-2026-45376: Decidim SQL injection in administrative user search

CVE-2026-45376 · Severity: medium · CVSS 6.8 · Published 2026-07-31

Executive brief

Decidim is an open-source platform used by governments and organizations to facilitate participatory democracy and citizen engagement. A security flaw in the administrative interface allows an authorized administrator to perform unauthorized database queries. This could lead to the exposure of sensitive internal data through specialized timing-based attacks, potentially compromising the privacy of the platform's users or internal operations.

Technical details

A blind SQL injection vulnerability exists in Decidim's administrative user search functionality. The 'GET /admin/organization/users' endpoint incorrectly interpolates the 'params[:term]' parameter into a raw 'Arel.sql' ORDER BY similarity expression without proper sanitization. An authenticated attacker with organization administrator privileges can exploit this to execute arbitrary PostgreSQL expressions. By observing timing differences in the server's response, the attacker can exfiltrate data from the database. The issue has been resolved by refactoring the autocomplete functionality to use a GraphQL API endpoint and ensuring proper parameter handling. Fixes are available in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Affected products

  • Decidim Decidim < 0.30.9, >= 0.31.0.rc1 < 0.31.5, >= 0.32.0.rc1 < 0.32.0.rc2

Timeline

  • 2026-07-31: advisory: NVD publication date
  • 2026-07-31: disclosed: GitHub Security Advisory published
  • 2026-05-09: patched: Fixes backported to various release branches

References

Related threats