The Decidim-admin application exposes an SQL injection vulnerability (CVE-2026-45376) in the GET /admin/organization/users endpoint. The vulnerability is due to unsafe interpolation of the user-controlled 'term' parameter into raw SQL ORDER BY expressions used for similarity-based sorting. Although the WHERE clauses use bind parameters, the ORDER BY clauses use Arel.sql with interpolated strings, bypassing Rails sanitization. This allows an authenticated admin user to inject arbitrary SQL code into the ORDER BY clause, which PostgreSQL executes as part of the sorting operation. Exploitation can be performed via blind SQL injection techniques, such as time delays using pg_sleep, to infer data or degrade availability. The issue affects decidim-admin versions before 0.30.9. A patch is referenced in the Decidim GitHub repository pull request #16668.

An authenticated organization admin can exploit this vulnerability to execute arbitrary SQL expressions within the database ORDER BY clause. This can lead to unauthorized data disclosure through blind SQL injection techniques, such as timing attacks, and potential denial of service by causing long-running queries. The impact is limited by the requirement for admin authentication but remains significant due to the ability to execute arbitrary SQL within the database context. The vulnerability does not directly affect data integrity or availability beyond induced delays but can expose sensitive information accessible to the database user.

A patch addressing this vulnerability is available in Decidim version 0.30.9 and later, as referenced in the Decidim GitHub pull request #16668. Users should upgrade to version 0.30.9 or later to remediate the issue. As a temporary workaround, restrict administrator access to trusted users only. No other mitigations are specifically recommended by the vendor advisory.