CVE Explorer
CVE-2026-45376
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"decidim","vendor":"decidim","versions":[{"status":"affected","version":"< 0.30.9"},{"status":"affected","version":">= 0.31.0.rc1, < 0.31.5"},{"status":"affected","version":">= 0.32.0.rc1, < 0.32.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/problemTypes/0/descriptions/0
Source references
8 source assertions{"name":"https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/1
{"name":"https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/2
{"name":"https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/3
{"name":"https://github.com/decidim/decidim/releases/tag/v0.30.9","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/releases/tag/v0.30.9"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/4
{"name":"https://github.com/decidim/decidim/releases/tag/v0.31.5","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/releases/tag/v0.31.5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/5
{"name":"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2","tags":["x_refsource_MISC"],"url":"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/6
{"tags":["exploit"],"url":"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/adp/0/references/0
{"name":"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37","tags":["x_refsource_CONFIRM"],"url":"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c8868c19c81427f289b9cb7bd6816d11c04e6f4d5ac164baae43e2d3616def10 · sha256:a133d33879212f0d… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.