CVE-2026-45376Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-45376 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users sea… https://www.cve.org/CVERecord?id=CVE-2026-45376 ----- Traducción: CVE-2026-45376 Dec… http://infoflow.cloud`
Post summary
The post announces the existence of CVE-2026-45376 in Decidim, noting vulnerable versions and the affected endpoint, but provides no PoC, exploit code, active exploitation, or mitigation details.
0000035
96 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-45376 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users sea… https://www.cve.org/CVERecord?id=CVE-2026-45376
Post summary
The tweet announces CVE-2026-45376 affecting specific Decidim versions but provides no additional exploit details or evidence of active use.
00000874
57.9K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-45376 Blind SQL Injection in Decidim Admin User Search via ORDER BY Similarity https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45376
Post summary
The post announces CVE-2026-45376 as a blind SQL injection flaw in Decidim, linking to a vulnerability details page without providing evidence of exploitation, patches, or a PoC.
00000103
4.1K followersView on X

Explore more

Back to dashboard