CVE-2026-45376
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences.
Risk Assessment
An organization administrator can read database data beyond their privileges, potentially leading to privilege escalation and data leakage.
Recommendation
Update Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2 (or later).
Other vulnerabilities in Decidim
See all- CVE-2026-45573Medium
Prior to versions 0.30.9, 0.31.5, and 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
- CVE-2026-45572Medium
Prior to versions 0.30.9, 0.31.5, and 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
- CVE-2026-45415Medium
Prior to versions 0.30.9, 0.31.5, and 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatum, allowing a participant manager to create, alter, or remove census records. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
- CVE-2026-45414High
Decidim prior to version 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path.
- CVE-2026-45378High
Decidim prior to version 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period.
- CVE-2026-45377Medium
In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the download_your_data flow requires authentication but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it.
- CVE-2026-45330Medium
In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request.
- CVE-2026-45086Medium
In Decidim versions 0.31.1 through 0.31.4 and 0.32.0.rc1, a regular participant can access the demographics questionnaire editor at /admin/demographics/questions/edit_questions without required administrator authorization. The route lacks an admin permission check.
Original NVD description (English source)
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.