GHSA/SYNC: 9 new decidim-related advisories

gems/decidim-admin/CVE-2026-45376.yml

@@ -0,0 +1,59 @@
+---
+gem: decidim-admin
+cve: 2026-45376
+ghsa: jvqq-cvh4-xm37
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45376
+title: Decidim - Admin user search allows SQL injection through
+  similarity-based sorting
+date: 2026-07-13
+description: |
+  ## Description
+
+  The admin organization user search uses the untrusted term value inside
+  raw SQL ORDER BY expressions. Because the value is interpolated before
+  Rails sanitization is applied, a crafted search string is executed by
+  PostgreSQL as part of the sort expression.
+
+  ## Impact
+
+  - Exploitation requires an authenticated admin session, which limits
+    exposure but does not remove the underlying SQL injection risk.
+  - An authenticated admin can inject arbitrary SQL expressions into
+    the query's `ORDER BY` clause and use timing differences as a
+    blind SQL oracle.
+  - The injection happens inside a database expression, so the effect
+    is not inherently limited to sorting the current organization user
+    relation. Depending on the privileges of the application's
+    PostgreSQL role, an attacker may be able to infer data from other
+    tables readable by that role.
+  - The issue remains exploitable even without verbose database errors
+    because time-based payloads such as `pg_sleep` provide a reliable
+    blind side channel.
+  - Repeated long-running payloads can also be used to degrade availability
+    by tying up database-backed requests.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 6.8
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45376
+    - https://rubygems.org/gems/decidim-admin/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16668
+    - https://advisories.gitlab.com/gem/decidim-admin/CVE-2026-45376
+    - https://github.com/decidim/decidim/security/advisories/GHSA-jvqq-cvh4-xm37
+    - https://github.com/advisories/GHSA-jvqq-cvh4-xm37
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.

gems/decidim-core/CVE-2026-45377.yml

@@ -0,0 +1,46 @@
+---
+gem: decidim-core
+cve: 2026-45377
+ghsa: 767h-63j4-5226
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45377
+title: Decidim -  Private exports can be downloaded through reusable links
+date: 2026-07-13
+description: |
+  ## Description
+
+  The normal `download_your_data` flow requires the requester to be
+  logged in as the export owner, but the resulting Active Storage blob
+  redirect URL can be replayed without authentication by anyone who obtains it.
+
+  ## Impact
+
+  Personal data exports can be retrieved through leakage channels such
+  as browser history, logs, referrers, screenshots, copied links, support
+  transcripts, intercepted email content, or other client-side disclosure
+  of the GET URL.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 6.5
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45377
+    - https://rubygems.org/gems/decidim-core/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16680
+    - https://advisories.gitlab.com/gem/decidim-core/CVE-2026-45377
+    - https://github.com/decidim/decidim/security/advisories/GHSA-767h-63j4-5226
+    - https://github.com/advisories/GHSA-767h-63j4-5226
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.

gems/decidim-core/CVE-2026-45572.yml

@@ -0,0 +1,48 @@
+---
+gem: decidim-core
+cve: 2026-45572
+ghsa: 533c-2vh9-4r86
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45572
+title: Decidim -  HTML content blocks allow stored script execution
+date: 2026-07-13
+description: |
+  ## Description
+
+  A privileged admin user who can edit an affected landing page can
+  store arbitrary HTML/JavaScript in an `HTML block`, and the public
+  page renders it with `html_safe` and no output escaping.
+
+  ## Impact
+
+  - A user with landing-page editing rights for an affected scope can
+    persist JavaScript that executes in visitor's browsers on that page.
+  - Because exploitation already requires privileged administrative
+    access, the practical risk is lower than a participant-controlled
+    or unauthenticated stored XSS. It still creates a browser-execution
+     primitive in a trusted admin-editable surface.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 4.8
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45572
+    - https://rubygems.org/gems/decidim-core/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16451
+    - https://advisories.gitlab.com/gem/decidim-core/CVE-2026-45572
+    - https://github.com/decidim/decidim/security/advisories/GHSA-533c-2vh9-4r86
+    - https://github.com/advisories/GHSA-533c-2vh9-4r86
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.

gems/decidim-core/CVE-2026-45573.yml

@@ -0,0 +1,53 @@
+---
+gem: decidim-core
+cve: 2026-45573
+ghsa: 2g9c-vf8h-prxx
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45573
+title: Decidim - Push subscriptions can be abused for server-side requests
+date: 2026-07-13
+description: |
+  ## Description
+
+  The push-subscription endpoint stores an attacker-controlled delivery
+  URL, and the notification send path becomes an outbound-request sink when
+  VAPID delivery is enabled. The practical result is an authenticated,
+  stored, mostly blind SSRF primitive to arbitrary HTTPS endpoints
+  reachable from the app server.
+
+  ## Impact
+
+  - In a configured deployment, an authenticated user can register an
+    attacker-controlled or otherwise unauthorized HTTPS URL.
+  - The server then sends outbound `POST` requests there whenever a
+    notification is pushed.
+  - This is a stored, mostly blind SSRF primitive: useful for outbound
+    interaction with attacker infrastructure and, where routable, internal
+    HTTPS services.
+  - Notification metadata is disclosed to the supplied endpoint through
+    the encrypted web push request path.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 6.4
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45573
+    - https://rubygems.org/gems/decidim-core/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16714
+    - https://advisories.gitlab.com/gem/decidim-core/CVE-2026-45573
+    - https://github.com/decidim/decidim/security/advisories/GHSA-2g9c-vf8h-prxx
+    - https://github.com/advisories/GHSA-2g9c-vf8h-prxx
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.

gems/decidim-demographics/CVE-2026-45086.yml

@@ -0,0 +1,44 @@
+---
+gem: decidim-demographics
+cve: 2026-45086
+ghsa: vq6j-hj8w-7v39
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45086
+title: Decidim - Forms admin question editor lacks authorization
+date: 2026-07-13
+description: |
+  ## Description
+
+  A participant can load the demographics questionnaire admin editor
+  and make changes.
+
+  ## Impact
+
+  - Low-privilege users can access questionnaire-admin interfaces.
+  - They can read question-management surfaces that should remain
+    limited to questionnaire managers.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 5.4
+unaffected_versions:
+  - "< 0.31.0"
+patched_versions:
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45086
+    - https://rubygems.org/gems/decidim-core/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/pull/16665
+    - https://advisories.gitlab.com/gem/decidim-demographics/CVE-2026-45086
+    - https://github.com/decidim/decidim/security/advisories/GHSA-vq6j-hj8w-7v39
+    - https://github.com/advisories/GHSA-vq6j-hj8w-7v39
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.

gems/decidim-verifications/CVE-2026-45330.yml

@@ -0,0 +1,40 @@
+---
+gem: decidim-verifications
+cve: 2026-45330
+ghsa: 86fh-w43w-338c
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45330
+title: Decidim - Verification admins can access supplied IDs from
+  other organizations
+date: 2026-07-13
+description: |
+  ## Description
+
+  The verification admin mutation flow allows accessing, verifying,
+  and rejecting participants records from another tenant.
+
+  ## Impact
+
+  A tenant admin can access, reject or approve another tenant's
+  `id_documents` requests.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 4.9
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://rubygems.org/gems/decidim-verifications/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16666
+    - https://advisories.gitlab.com/gem/decidim-verifications/CVE-2026-45330
+    - https://github.com/decidim/decidim/security/advisories/GHSA-86fh-w43w-338c
+    - https://github.com/advisories/GHSA-86fh-w43w-338c

gems/decidim-verifications/CVE-2026-45378.yml

@@ -0,0 +1,60 @@
+---
+gem: decidim-verifications
+cve: 2026-45378
+ghsa: 3mvf-82qp-8qh5
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45378
+title: Decidim - Verification documents can be downloaded through reusable links
+date: 2026-07-13
+description: |
+  ## Description
+
+  Scanned identity-document images provided by participants and shown
+  in the verification admin workflow are exposed through signed
+  `/rails/active_storage/disk/` URLs that can be fetched without any
+  authenticated session.
+
+  Anyone who obtains one of those URLs can retrieve the document until
+  the signature expires.
+
+  ## Impact
+
+  - This only applies to Organizations using the \"Identity documents\"
+    verification
+  - Any party that obtains one of these URLs can download the underlying
+    scanned identity document for the lifetime of the signed link without needing to
+    authenticate as the reviewing admin.
+  - In the reproduced case, that replay window was about seven days,
+    which is long enough for routine leakage channels such as copied links,
+    screenshots, logs, browser history, and support workflows to become
+    realistic exfiltration paths.
+  - This raises the risk of leakage through browser history, screenshots,
+    copy-paste, support tickets, logs, analytics tooling, malicious
+    browser extensions, or any other channel that captures full URLs.
+  - Because the affected files are identity-verification documents, the
+    exposed data can include highly sensitive personal information.
+
+  ## Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 7.5
+patched_versions:
+  - "~> 0.30.9"
+  - "~> 0.31.5"
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-45378
+    - https://rubygems.org/gems/decidim-core/versions/0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.32.0
+    - https://github.com/decidim/decidim/releases/tag/v0.31.5
+    - https://github.com/decidim/decidim/releases/tag/v0.30.9
+    - https://github.com/decidim/decidim/pull/16680
+    - https://advisories.gitlab.com/gem/decidim-verifications/CVE-2026-45378
+    - https://github.com/decidim/decidim/security/advisories/GHSA-3mvf-82qp-8qh5
+    - https://github.com/advisories/GHSA-3mvf-82qp-8qh5
+notes: |
+  - CVE is reserved, but not published.
+  - cvss_v3 value came from GHSA.