CVE-2026-45376
Published: Fri, 31 Jul 2026 23:17
Summary
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] int
Details
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Are YOU affected by CVE-2026-45376?
5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether CVE-2026-45376 (and any other live CVE) applies. Anonymous, no signup.
curl https://mindsparkstack.com/scan.sh | bash
References
- https://github.com/decidim/decidim/commit/27335957b363516e23919a9006812f1c458c88e0
- https://github.com/decidim/decidim/commit/e4d21b41fb462d9436035a043962a4090f2cc240
- https://github.com/decidim/decidim/commit/f3817fac448a4e3facd6bcb346167048b3421124
- https://github.com/decidim/decidim/releases/tag/v0.30.9
- https://github.com/decidim/decidim/releases/tag/v0.31.5
- https://github.com/decidim/decidim/releases/tag/v0.32.0.rc2
- https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37
- https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37
StackPatch runs this match against YOUR installed packages every hour
Free (3 servers) / from $9/mo (14-day free trial) / Solo $9/mo / Pro $29/mo / Team $79/mo. Indie pricing.