SQL Injection Affecting decidim-conferences package, versions <0.30.9>=0.31.0.rc1, <0.31.5>=0.32.0.rc1, <0.32.0.rc2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-DECIDIMCONFERENCES-17970861
- published14 Jul 2026
- disclosed13 Jul 2026
- creditUnknown
Introduced: 13 Jul 2026
NewCVE-2026-45376 (opens in a new tab)How to fix?
Upgrade decidim-conferences to version 0.30.9, 0.31.5, 0.32.0.rc2 or higher.
Overview
Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params[:term] is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions within the database sort operation by supplying crafted input, potentially inferring sensitive data or causing performance degradation through time-based payloads. This is only exploitable if the attacker has authenticated admin privileges.
Workaround
This vulnerability can be mitigated by restricting administrator access to trusted users only.