Vulnerability-Lookup

CVE-2026-45376 (GCVE-0-2026-45376)

Vulnerability from cvelistv5 – Published: 2026-07-31 22:34 – Updated: 2026-08-03 17:13

Title

Decidim: Admin user search allows SQL injection through similarity-based sorting

Summary

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/decidim/decidim/security/advis…	x_refsource_CONFIRM
https://github.com/decidim/decidim/commit/2733595…	x_refsource_MISC
https://github.com/decidim/decidim/commit/e4d21b4…	x_refsource_MISC
https://github.com/decidim/decidim/commit/f3817fa…	x_refsource_MISC
https://github.com/decidim/decidim/releases/tag/v0.30.9	x_refsource_MISC
https://github.com/decidim/decidim/releases/tag/v0.31.5	x_refsource_MISC
https://github.com/decidim/decidim/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
decidim	decidim	Affected: < 0.30.9 Affected: >= 0.31.0.rc1, < 0.31.5 Affected: >= 0.32.0.rc1, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45376",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:12:17.950662Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:13:15.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "decidim",
          "vendor": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.31.0.rc1, \u003c 0.31.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.32.0.rc1, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T22:34:27.181Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"
        },
        {
          "name": "https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0"
        },
        {
          "name": "https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240"
        },
        {
          "name": "https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124"
        },
        {
          "name": "https://github.com/decidim/decidim/releases/tag/v0.30.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/releases/tag/v0.30.9"
        },
        {
          "name": "https://github.com/decidim/decidim/releases/tag/v0.31.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/releases/tag/v0.31.5"
        },
        {
          "name": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2"
        }
      ],
      "source": {
        "advisory": "GHSA-jvqq-cvh4-xm37",
        "discovery": "UNKNOWN"
      },
      "title": "Decidim: Admin user search allows SQL injection through similarity-based sorting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45376",
    "datePublished": "2026-07-31T22:34:27.181Z",
    "dateReserved": "2026-05-12T00:51:29.086Z",
    "dateUpdated": "2026-08-03T17:13:15.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45376",
      "date": "2026-08-03",
      "epss": "0.00341",
      "percentile": "0.26819"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45376\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-31T23:17:24.373\",\"lastModified\":\"2026-07-31T23:17:24.373\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"decidim\",\"product\":\"decidim\",\"versions\":[{\"version\":\"\u003c 0.30.9\",\"status\":\"affected\"},{\"version\":\"\u003e= 0.31.0.rc1, \u003c 0.31.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 0.32.0.rc1, \u003c 0.32.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/releases/tag/v0.30.9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/releases/tag/v0.31.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45376\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-03T17:12:17.950662Z\"}}}], \"references\": [{\"url\": \"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-03T17:12:37.682Z\"}}], \"cna\": {\"title\": \"Decidim: Admin user search allows SQL injection through similarity-based sorting\", \"source\": {\"advisory\": \"GHSA-jvqq-cvh4-xm37\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"decidim\", \"product\": \"decidim\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.30.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.31.0.rc1, \u003c 0.31.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.32.0.rc1, \u003c 0.32.0\"}]}], \"references\": [{\"url\": \"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37\", \"name\": \"https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0\", \"name\": \"https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240\", \"name\": \"https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124\", \"name\": \"https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decidim/decidim/releases/tag/v0.30.9\", \"name\": \"https://github.com/decidim/decidim/releases/tag/v0.30.9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decidim/decidim/releases/tag/v0.31.5\", \"name\": \"https://github.com/decidim/decidim/releases/tag/v0.31.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2\", \"name\": \"https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-31T22:34:27.181Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45376\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-03T17:13:15.144Z\", \"dateReserved\": \"2026-05-12T00:51:29.086Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-31T22:34:27.181Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-JVQQ-CVH4-XM37

Vulnerability from github – Published: 2026-07-13 16:59 – Updated: 2026-07-13 16:59

Summary

Decidim: Admin user search allows SQL injection through similarity-based sorting

Details

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.30.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.31.0.rc1"
            },
            {
              "fixed": "0.31.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.32.0.rc1"
            },
            {
              "fixed": "0.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-13T16:59:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.\n\n### Technical description\n \nThe vulnerable endpoint is exposed as GET `/admin/organization/users` in `decidim-admin/config/routes.rb`:\n\n```ruby\nresource :organization, only: [:edit, :update], controller: \"organization\" do\n  member do\n    get :users\n  end\nend\n```\n\nThat route reaches `Decidim::Admin::OrganizationController#users`, which forwards the current organization\u0027s available users into `search`:\n\n```ruby\ndef users\n  search(current_organization.users.available)\nend\n```\n\nInside `search`, the attacker-controlled source is `params[:term]`:\n\n```ruby\nif (term = params[:term].to_s).present?\n```\n\nThe query has two branches. In both branches, the `WHERE` predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent `.order(Arel.sql(...))` calls, where the untrusted value is interpolated directly into SQL string literals.\n\nNickname branch:\n\n```ruby\nnickname = term.delete(\"@\")\nrelation.where(\"nickname LIKE ?\", \"#{nickname}%\")\n  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array(\"similarity(nickname, \u0027#{nickname}\u0027) DESC\")))\n```\n\nName/email branch:\n\n```ruby\nrelation.where(\"name ILIKE ?\", \"%#{term}%\").or(\n  relation.where(\"email ILIKE ?\", \"%#{term}%\")\n)\n  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array(\"GREATEST(similarity(name, \u0027#{term}\u0027), similarity(email, \u0027#{term}\u0027)) DESC\")))\n  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array(\"(similarity(name, \u0027#{term}\u0027) + similarity(email, \u0027#{term}\u0027)) / 2 DESC\")))\n```\n\nThis use of `sanitize_sql_array` does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in `term` can terminate the intended string literal and inject attacker-controlled SQL into the `ORDER BY` expression.\n\nFor example, a payload such as `slpleak \u0027), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --` produces a fragment equivalent to:\n\n```sql\nGREATEST(similarity(name, \u0027slpleak \u0027), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --\u0027), similarity(email, \u0027slpleak \u0027), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --\u0027)) DESC\n``` \n\nThe injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in `ORDER BY`, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.\n\nSource-to-sink chain:\n\n* Source: `params[:term]`\n* Propagation: `term = params[:term].to_s`\n* Sink: `.order(Arel.sql(... \"#{term}\" ...))` and `.order(Arel.sql(... \"#{nickname}\" ...))`\n* Effect: attacker-controlled SQL is executed inside the database sort expression\n\nReproduction steps:\n\n1. Authenticate as an organization admin.\n2. Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary\nuser whose `name`, `email`, or `nickname` matches the probe string.\n3. Send a control request to `GET /admin/organization/users?term=test` with `Accept: application/json` and record the response time.\n4. Send a payload request such as `GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20--` with `Accept: application/json`.\n5. Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep\ninterval, demonstrating time-based SQL execution in the `ORDER BY` clause.\n\n### Impact\n\n- Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.\n- An authenticated admin can inject arbitrary SQL expressions into the query\u0027s `ORDER BY` clause and use timing differences as a blind SQL oracle.\n- The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application\u0027s PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.\n- The issue remains exploitable even without verbose database errors because time-based payloads such as `pg_sleep` provide a reliable blind side channel.\n- Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16668 \n\n### Workarounds\n\nReview your administrator accesses and not give access to untrustworthy users\n\n### Reference\n\nOWASP SQL Injection\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).",
  "id": "GHSA-jvqq-cvh4-xm37",
  "modified": "2026-07-13T16:59:49Z",
  "published": "2026-07-13T16:59:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/pull/16668"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decidim/decidim"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Decidim: Admin user search allows SQL injection through similarity-based sorting"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted