---
id: CVE-2026-45376
title: Decidim is a participatory democracy framework
summary: >-
  Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0
  before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET
  /admin/organization/users search interpolates params[:term] into raw Arel.sql
  ORDER BY similarity ex…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L'
cwe:
  - CWE-89
vendor: decidim-admin
product: decidim-admin
affected:
  - decidim-admin < 0.30.9
  - 'decidim-admin >= 0.31.0.rc1, < 0.31.5'
  - 'decidim-admin >= 0.32.0.rc1, < 0.32.0'
patched:
  - decidim-admin 0.30.9
  - decidim-admin 0.31.5
  - decidim-admin 0.32.0
published: '2026-07-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45376'
references:
  - url: >-
      https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0
    label: security-advisories@github.com
  - url: >-
      https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240
    label: security-advisories@github.com
  - url: >-
      https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124
    label: security-advisories@github.com
  - url: 'https://github.com/decidim/decidim/releases/tag/v0.30.9'
    label: security-advisories@github.com
  - url: 'https://github.com/decidim/decidim/releases/tag/v0.31.5'
    label: security-advisories@github.com
  - url: 'https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2'
    label: security-advisories@github.com
  - url: 'https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37'
    label: security-advisories@github.com
  - url: 'https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/decidim/decidim/pull/16668'
  - url: 'https://github.com/advisories/GHSA-jvqq-cvh4-xm37'
tags:
  - nvd
  - ghsa
  - rubygems
epss: 0.00341
epssPercentile: 0.27768
aliases:
  - GHSA-jvqq-cvh4-xm37
ecosystem: rubygems
scores:
  nvd: 5.5
  ghsa: 6.8
ingestedAt: '2026-07-13T17:27:59.033Z'
---

## Overview

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-45376)

Affected packages:

- `decidim-admin < 0.30.9`
- `decidim-admin >= 0.31.0.rc1, < 0.31.5`
- `decidim-admin >= 0.32.0.rc1, < 0.32.0`

Patched in:

- `decidim-admin 0.30.9`
- `decidim-admin 0.31.5`
- `decidim-admin 0.32.0`

Source: https://github.com/advisories/GHSA-jvqq-cvh4-xm37