CVE-2026-45376 is a blind SQL injection in Decidim's admin user search endpoint, but describing it as SQL injection misses the point. This is a multi-tenant isolation bypass. Decidim treats 'organization' as its security boundary — administrators are scoped to manage their own organization's users and processes. This vulnerability lets an authenticated organization admin probe data belonging to other organizations through timing-based inference in the ORDER BY clause.
The injection lives in the user search endpoint's sort parameters. Because it's ORDER BY rather than WHERE, the attacker cannot modify query logic — they can only infer data through error messages or timing differences (e.g., whether a query takes longer when testing whether a specific substring exists in another organization's user email). This constraint makes exploitation slow and noisy, which explains the low EPSS score. But slow exfiltration is still exfiltration. One successful probe demonstrates that the tenant isolation guarantee is broken, regardless of how long it takes.
The CVSS 5.5 rating reflects the technical injection mechanism (availability impact via timing, low confidentiality under CVSS's model) but ignores that this attack is launched by an insider with legitimate administrative credentials. For multi-tenant Decidim deployments, the real question is not whether raw SQL executes — it's what data an admin can reach that their role should deny them. If Organization A and Organization B share the same database with logical separation only, an admin from A can enumerate users in B, map email patterns, or infer organizational structure through systematic probing.
Check your Decidim deployment immediately: verify whether the admin search interfaces across all modules use parameterized queries or raw Arel interpolation. The disclosed fix — replacing Arel.sql() interpolation with proper Arel node methods — should be applied systemically, not just to the single reported endpoint. Audit other admin search interfaces for the same pattern. Also confirm whether your deployment uses schema-level tenant isolation (separate databases or schemas per organization) or only logical separation within a shared database; the latter leaves you exposed to this entire class of inference attacks regardless of patching.
This vulnerability should be prioritized as a trust-model failure rather than a medium-severity injection. The attack surface is limited to authenticated admins, but the impact is a complete breakdown of the multi-tenant security boundary that Decidim is built on.