Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Affected: RubyGems: decidim-admin

The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression.

### Technical description The vulnerable endpoint is exposed as GET `/admin/organization/users` in `decidim-admin/config/routes.rb`:

```ruby resource :organization, only: [:edit, :update], controller: "organization" do member do get :users end end ```

That route reaches `Decidim::Admin::OrganizationController#users`, which forwards the current organization's available users into `search`:

```ruby def users search(current_organization.users.available) end ```

Inside `search`, the attacker-controlled source is `params[:term]`:

```ruby if (term = params[:term].to_s).present? ```

The query has two branches. In both branches, the `WHERE` predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent `.order(Arel.sql(...))` calls, where the untrusted value is interpolated directly into SQL string literals.

Nickname branch:

```ruby nickname = term.delete("@") relation.where("nickname LIKE ?", "#{nickname}%") .order(Arel.sql(ActiveRecord::Base.sanitize_sql_array("similarity(nickname, '#{nickname}') DESC"))) ```

Name/email branch:

```ruby relation.where("name ILIKE ?", "%#{term}%").or( relation.where("email ILIKE ?", "%#{term}%") ) .order(Arel.sql(ActiveRecord::Base…