CVE-2026-45376 in Decidim
Summary
by MITRE • 08/01/2026
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability exists within the Decidim participatory democracy framework where authenticated organization administrators can exploit a SQL injection flaw in the user search functionality. The issue manifests specifically in the GET /admin/organization/users endpoint where the params[:term] parameter is directly interpolated into raw Arel.sql ORDER BY similarity expressions without proper sanitization. This represents a classic case of improper input validation and output encoding that allows attackers to manipulate database queries through crafted input values.
The technical flaw stems from the application's failure to properly escape or parameterize user-supplied input before incorporating it into SQL query structures. When administrators perform searches within the user management interface, the system constructs database queries using Arel.sql methods that directly concatenate the term parameter into the ORDER BY clause for similarity matching operations. This creates an environment where malicious input can alter the intended query structure and potentially execute arbitrary SQL commands against the underlying PostgreSQL database.
This vulnerability enables blind SQL injection attacks through timing-based data exfiltration techniques, allowing authenticated attackers to infer database contents without direct output mechanisms. The attacker can craft specific search terms that cause the database to perform time-consuming operations when processing the similarity expressions, thereby enabling them to determine information about the database structure and content through differential response times. This type of attack pattern aligns with common ATT&CK techniques for credential access and defense evasion, particularly leveraging the use of timing attacks for data inference.
The operational impact of this vulnerability is significant as it compromises the integrity and confidentiality of user data within the participatory democracy platform. An authenticated administrator with malicious intent could potentially extract sensitive information about users, system configurations, or other database contents through careful manipulation of search parameters. The vulnerability affects multiple version ranges including 0.30.0 through 0.30.8, 0.31.0 through 0.31.4, and 0.32.0.rc1 through 0.32.0.rc1, representing a substantial portion of the framework's release history. The fix implemented in versions 0.30.9, 0.31.5, and 0.32.0.rc2 demonstrates proper input sanitization and parameterized query construction approaches that prevent such injection vulnerabilities.
Security mitigations should focus on implementing proper input validation and parameterization techniques for all database interactions, particularly those involving user-supplied data in dynamic SQL contexts. The fix should employ prepared statements or parameterized queries that properly separate the SQL command structure from the data values, preventing any possibility of command injection through user input. Organizations using Decidim should immediately upgrade to the patched versions and implement additional monitoring for unusual search patterns or timing variations that might indicate exploitation attempts. This vulnerability classification aligns with CWE-89 for SQL injection and represents a critical security concern that directly impacts the trustworthiness of participatory democratic platforms handling sensitive user information.