CVE-2026-45376 decidim CVE debrief

Who should care

Organization administrators using Decidim framework versions prior to 0.30.9, 0.31.5, or 0.32.0.rc2 should be aware of this vulnerability and take steps to patch their instances. This includes reviewing the current version, assessing exposure, and applying patches or mitigations as necessary. Additionally, security teams and vulnerability management teams should monitor for potential exploitation and review compensating controls for exposed systems while remediation is scheduled and verified. Operators and platform administrators should also be aware of the potential impact on their systems and take steps to protect them. This vulnerability may require updates to security policies, procedures, and monitoring to ensure adequate protection against potential threats. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented. The CVE record indicates a blind SQL injection vulnerability in Decidim versions prior to 0.30.9, 0.31.5, and 0.32.0.rc2. An authenticated organization administrator could exploit this vulnerability to execute PostgreSQL expressions and infer data through timing differences. The vulnerability has not been modified since its publication on 2026-07-31T23:17:24.373Z. Therefore, it is essential to prioritize patching vulnerable Decidim instances to prevent potential data inference through timing differences. The vulnerability affects multiple versions of the Decidim framework, emphasizing the need for immediate attention from organization administrators and security teams. The vulnerability's impact on the system can be significant, making it crucial for administrators to take prompt action to mitigate the risk. The vulnerability's details and affected versions are well-documented, allowing administrators to assess their exposure accurately and plan accordingly. Overall, organization administrators, security teams, and operators must work together to address this vulnerability effectively and protect their systems from potential threats. The vulnerability's severity and potential impact underscore the importance of prompt action to prevent data inference and ensure the security ofDec

Technical summary

The Decidim framework has a blind SQL injection vulnerability in versions prior to 0.30.9, 0.31.5, and 0.32.0.rc2. An authenticated organization administrator can exploit this vulnerability by injecting malicious SQL expressions through the GET /admin/organization/users search endpoint, allowing for potential data inference through timing differences. The vulnerability is caused by the interpolation of user-input parameters into raw Arel.sql ORDER BY similarity expressions before sanitization.

Defensive priority

Authenticated organization administrators should prioritize patching vulnerable Decidim instances to prevent potential data inference through timing differences.

Recommended defensive actions

• Patch vulnerable Decidim instances to version 0.30.9, 0.31.5, or 0.32.0.rc2
• Restrict access to organization administrator roles
• Monitor for suspicious database queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record indicates a blind SQL injection vulnerability in Decidim versions prior to 0.30.9, 0.31.5, and 0.32.0.rc2. An authenticated organization administrator could exploit this vulnerability to execute PostgreSQL expressions and infer data through timing differences.

Official resources