decidim-admin

Version	Released
`0.32.2` patch	Oct 22, 2026
`0.31.8` patch	Oct 22, 2026
`0.32.1` patch	Jul 30, 2026
`0.31.7` patch	Jul 30, 2026
`0.31.6` patch	Jul 06, 2026
`0.32.0` minor	Jul 02, 2026
`0.32.0.rc3` pre 1 CVE	Jun 02, 2026
`0.32.0.rc2` pre 1 CVE	May 12, 2026
`0.30.9` patch	May 12, 2026
`0.31.5` patch	May 12, 2026
`0.32.0.rc1` pre 1 CVE	Apr 24, 2026
`0.31.4` patch 1 CVE	Apr 24, 2026
`0.30.8` patch 1 CVE	Apr 24, 2026
`0.31.3` patch 1 CVE	Mar 26, 2026
`0.30.7` patch 1 CVE	Mar 26, 2026
`0.31.2` patch 1 CVE	Feb 26, 2026
`0.30.6` patch 1 CVE	Feb 26, 2026
`0.31.1` patch 1 CVE	Jan 28, 2026
`0.30.5` patch 1 CVE	Jan 28, 2026
`0.29.7` patch 1 CVE	Nov 20, 2025
`0.31.0` minor 1 CVE	Nov 20, 2025
`0.30.4` patch 1 CVE	Nov 20, 2025
`0.30.3` patch 1 CVE	Oct 28, 2025
`0.31.0.rc2` pre 1 CVE	Oct 28, 2025
`0.29.6` patch 1 CVE	Oct 28, 2025
`0.31.0.rc1` pre 1 CVE	Sep 25, 2025
`0.29.5` patch 1 CVE	Sep 23, 2025
`0.30.2` patch 1 CVE	Sep 23, 2025
`0.29.4` patch 1 CVE	Jun 04, 2025
`0.30.1` patch 1 CVE	Jun 04, 2025
`0.28.6` patch 1 CVE	Apr 29, 2025
`0.29.3` patch 1 CVE	Apr 29, 2025
`0.30.0` minor 1 CVE	Apr 29, 2025
`0.27.10` patch 1 CVE	Mar 20, 2025
`0.30.0.rc3` pre 1 CVE	Mar 19, 2025
`0.30.0.rc2` pre 1 CVE	Mar 03, 2025
`0.30.0.rc1` pre 1 CVE	Feb 18, 2025
`0.28.5` patch 1 CVE	Feb 12, 2025
`0.29.2` patch 1 CVE	Feb 12, 2025
`0.29.1` patch 1 CVE	Oct 02, 2024
`0.28.4` patch 1 CVE	Oct 02, 2024
`0.27.9` patch 1 CVE	Sep 10, 2024
`0.28.3` patch 1 CVE	Sep 10, 2024
`0.29.0` minor 1 CVE	Sep 10, 2024
`0.29.0.rc4` pre 1 CVE	Jul 30, 2024
`0.27.8` patch 1 CVE	Jul 30, 2024
`0.29.0.rc3` pre 1 CVE	Jul 22, 2024
`0.29.0.rc2` pre 1 CVE	Jul 16, 2024
`0.29.0.rc1` pre 1 CVE	Jul 16, 2024
`0.28.2` patch 1 CVE	Jul 16, 2024

0.32.2 patch

Oct 22, 2026

0.31.8 patch

Oct 22, 2026

0.32.1 patch

Jul 30, 2026

0.31.7 patch

Jul 30, 2026

0.31.6 patch

Jul 06, 2026

0.32.0 minor

Jul 02, 2026

0.32.0.rc3 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jun 02, 2026

0.32.0.rc2 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

May 12, 2026

0.30.9 patch

May 12, 2026

0.31.5 patch

May 12, 2026

0.32.0.rc1 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 24, 2026

0.31.4 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 24, 2026

0.30.8 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 24, 2026

0.31.3 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Mar 26, 2026

0.30.7 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Mar 26, 2026

0.31.2 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Feb 26, 2026

0.30.6 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Feb 26, 2026

0.31.1 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jan 28, 2026

0.30.5 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jan 28, 2026

0.29.7 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Nov 20, 2025

0.31.0 minor

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Nov 20, 2025

0.30.4 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Nov 20, 2025

0.30.3 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Oct 28, 2025

0.31.0.rc2 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Oct 28, 2025

0.29.6 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Oct 28, 2025

0.31.0.rc1 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 25, 2025

0.29.5 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 23, 2025

0.30.2 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 23, 2025

0.29.4 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jun 04, 2025

0.30.1 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jun 04, 2025

0.28.6 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 29, 2025

0.29.3 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 29, 2025

0.30.0 minor

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Apr 29, 2025

0.27.10 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Mar 20, 2025

0.30.0.rc3 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Mar 19, 2025

0.30.0.rc2 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Mar 03, 2025

0.30.0.rc1 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Feb 18, 2025

0.28.5 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Feb 12, 2025

0.29.2 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Feb 12, 2025

0.29.1 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Oct 02, 2024

0.28.4 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Oct 02, 2024

0.27.9 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 10, 2024

0.28.3 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 10, 2024

0.29.0 minor

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Sep 10, 2024

0.29.0.rc4 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 30, 2024

0.27.8 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 30, 2024

0.29.0.rc3 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 22, 2024

0.29.0.rc2 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 16, 2024

0.29.0.rc1 pre

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 16, 2024

0.28.2 patch

1 CVE

CVE-2026-45376 GHSA-jvqq-cvh4-xm37 Jul 13, 2026

Decidim: Admin user search allows SQL injection through similarity-based sorting

6.8 / 10

Medium

Network Low High None Changed High None None

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

Technical description

The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb:

resource :organization, only: [:edit, :update], controller: "organization" do
  member do
    get :users
  end
end

That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search:

def users
  search(current_organization.users.available)
end

Inside search, the attacker-controlled source is params[:term]:

if (term = params[:term].to_s).present?

The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

nickname = term.delete("@")
relation.where("nickname LIKE ?", "#{nickname}%")
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC")))

Name/email branch:

relation.where("name ILIKE ?", "%#{term}%").or(
  relation.where("email ILIKE ?", "%#{term}%")
)
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("GREATEST(similarity(name, '#{term}'), similarity(email, '#{term}')) DESC")))
  .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("(similarity(name, '#{term}') + similarity(email, '#{term}')) / 2 DESC")))

This use of sanitize_sql_array does not make the code safe. The interpolation happens first, so Rails receives an already-built SQL string rather than a statement with bind placeholders. As a result, a quote in term can terminate the intended string literal and inject attacker-controlled SQL into the ORDER BY expression.

For example, a payload such as slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) -- produces a fragment equivalent to:

GREATEST(similarity(name, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --'), similarity(email, 'slpleak '), COALESCE((SELECT 1 FROM pg_sleep(21)),0)) --')) DESC

The injected subquery is therefore evaluated by PostgreSQL as SQL, not treated purely as data. Because the sink is in ORDER BY, the endpoint can still return a normal 200 OK response while exposing the issue through measurable timing differences.

Source-to-sink chain:

Source: params[:term]
Propagation: term = params[:term].to_s
Sink: .order(Arel.sql(... "#{term}" ...)) and .order(Arel.sql(... "#{nickname}" ...))
Effect: attacker-controlled SQL is executed inside the database sort expression

Reproduction steps:

Authenticate as an organization admin.
Ensure the search returns at least one row for the chosen payload. For a deterministic test, create a temporary user whose name, email, or nickname matches the probe string.
Send a control request to GET /admin/organization/users?term=test with Accept: application/json and record the response time.
Send a payload request such as GET /admin/organization/users?term=slpleak%20%27%29%2C%20COALESCE%28%28SELECT%201%20FROM%20pg_sleep%2821%29%29%2C0%29%29%20-- with Accept: application/json.
Observe that the endpoint still responds successfully, but the response time increases by approximately the sleep interval, demonstrating time-based SQL execution in the ORDER BY clause.

Impact

Exploitation requires an authenticated admin session, which limits exposure but does not remove the underlying SQL injection risk.
An authenticated admin can inject arbitrary SQL expressions into the query's ORDER BY clause and use timing differences as a blind SQL oracle.
The injection happens inside a database expression, so the effect is not inherently limited to sorting the current organization user relation. Depending on the privileges of the application's PostgreSQL role, an attacker may be able to infer data from other tables readable by that role.
The issue remains exploitable even without verbose database errors because time-based payloads such as pg_sleep provide a reliable blind side channel.
Repeated long-running payloads can also be used to degrade availability by tying up database-backed requests.

Patches

See https://github.com/decidim/decidim/pull/16668

Workarounds

Review your administrator accesses and not give access to untrustworthy users

Reference

OWASP SQL Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Affected versions


          0.0.1


          0.0.1.alpha3


          0.0.1.alpha4


          0.0.1.alpha5


          0.0.1.alpha6


          0.0.1.alpha7


          0.0.1.alpha8


          0.0.1.alpha9


          0.0.2


          0.0.3


          0.0.5


          0.0.6

+ 158 more


            0.0.7


            0.0.8.1


            0.1.0


            0.10.0


            0.10.1


            0.11.0.pre1


            0.11.1


            0.11.2


            0.12.0


            0.12.0.pre


            0.12.1


            0.12.2


            0.13.0


            0.13.0.pre1


            0.13.1


            0.14.1


            0.14.2


            0.14.3


            0.14.4


            0.15.0


            0.15.1


            0.15.2


            0.16.0


            0.16.1


            0.17.0


            0.17.1


            0.17.2


            0.18.0


            0.18.1


            0.19.0


            0.19.1


            0.2.0


            0.20.0


            0.20.1


            0.21.0


            0.22.0


            0.23.0


            0.23.1


            0.23.1.rc1


            0.23.2


            0.23.3


            0.23.4


            0.23.5


            0.23.6


            0.24.0


            0.24.0.rc1


            0.24.0.rc2


            0.24.1


            0.24.2


            0.24.3


            0.25.0


            0.25.0.rc1


            0.25.0.rc2


            0.25.0.rc3


            0.25.0.rc4


            0.25.1


            0.25.2


            0.26.0


            0.26.0.rc1


            0.26.0.rc2


            0.26.1


            0.26.10


            0.26.2


            0.26.3


            0.26.4


            0.26.5


            0.26.7


            0.26.8


            0.26.9


            0.27.0


            0.27.0.rc1


            0.27.0.rc2


            0.27.1


            0.27.10


            0.27.2


            0.27.3


            0.27.4


            0.27.5


            0.27.6


            0.27.7


            0.27.8


            0.27.9


            0.28.0


            0.28.0.rc4


            0.28.0.rc5


            0.28.1


            0.28.2


            0.28.3


            0.28.4


            0.28.5


            0.28.6


            0.29.0


            0.29.0.rc1


            0.29.0.rc2


            0.29.0.rc3


            0.29.0.rc4


            0.29.1


            0.29.2


            0.29.3


            0.29.4


            0.29.5


            0.29.6


            0.29.7


            0.3.0


            0.3.1


            0.3.2


            0.30.0


            0.30.0.rc1


            0.30.0.rc2


            0.30.0.rc3


            0.30.1


            0.30.2


            0.30.3


            0.30.4


            0.30.5


            0.30.6


            0.30.7


            0.30.8


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.5.0


            0.5.1


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.8.0


            0.8.1


            0.8.2


            0.8.3


            0.8.4


            0.9.0


            0.9.1


            0.9.2


            0.9.3


            0.31.0


            0.31.0.rc1


            0.31.0.rc2


            0.31.1


            0.31.2


            0.31.3


            0.31.4


            0.32.0.rc1


            0.32.0.rc2


            0.32.0.rc3

Fixed in


          0.30.9


          0.31.5


          0.32.0

References

Updated Jul 13, 2026 · Source: OSV.dev

Jul 16, 2024

Activity

Reach

Details