Decidim’s admin user search endpoint constructs raw SQL ORDER BY clauses using the user‑supplied search term before sanitization. Because the term is interpolated into an Arel.sql expression, an authenticated organization administrator can cause the database to evaluate arbitrary PostgreSQL expressions. The vulnerability only yields blind information gain via timing, but it allows the attacker to infer sensitive data such as usernames or emails.

The issue exists in Decidim framework versions earlier than 0.30.9, in 0.31.0 up to (but not including) 0.31.5, and in 0.32.0.rc1 through just before 0.32.0.rc2. The official patches are distributed with releases 0.30.9, 0.31.5 and 0.32.0.rc2; any version less than those is vulnerable.

With a CVSS score of 5.5, the vulnerability is considered moderate. The EPSS score is listed as less than 1%, indicating a very low probability of exploitation in the wild. Decidim is not present in the CISA KEV catalog, and the attack requires active authenticated access to the organization’s admin interface via a web request. An attacker possessing or obtaining organization‑administrator credentials could use the flaw to extract data in time‑based increments, potentially compromising confidentiality of user identities across the platform.