CVE-2026-23891

Decidim has a Cross-site scripting (XSS) vulnerability via user name field

Published Apr 13, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.

Analysis

Technical impact

This vulnerability allows a stored cross‑site scripting flaw through the user name field, enabling a low‑privileged attacker to inject code that is executed in the browser context of any visitor to a comment page. The exploited code runs with the privileges of the visiting user, providing high confidentiality and integrity impact across security boundaries.

Affected Systems

Decidim users running the open‑source participatory democracy framework are affected. Versions lower than 0.30.5, and releases 0.31.0.rc1 to 0.31.0, are vulnerable. All other versions, including 0.30.5 and 0.31.1, contain the fix.

Risk and Exploitability

The flaw has a high CVSS score of 9.3 and is listed as a stored XSS that facilitates arbitrary code execution. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. The attack can be performed by any user who can create or modify a comment with a maliciously crafted name; the victim simply needs to open the comment page, making exploitation highly feasible for an attacker with minimal resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

decidim

affected

Version	Status	Constraints
`>= 0.31.0.rc1, < 0.31.1`	affected	—
`< 0.30.5`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:decidim:decidim::::::ruby::*
	cpe:2.3:a:decidim:decidim::::::ruby::*

No data.

Vendor Product Versions

Decidim

Version	Status	Scheme	Platform
`[0.31.0.rc1,0.31.1)`	affected	semver	—
`[0,0.30.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Decidim to version 0.30.5 or later 0.31.1
Confirm that the application runs the patched version

Generated by OpenCVE AI on April 13, 2026 at 18:22 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-fc46-r95f-hq7g	Decidim has a cross-site scripting (XSS) in user name

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.370% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/decidim/decidim/releases/tag/v0.30.5
https://github.com/decidim/decidim/releases/tag/v0.31.1
https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g

History

Apr 22, 2026 4:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:decidim:decidim::::::ruby::*
Metrics		cvssV3_1 `{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}`

Apr 14, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 14, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Decidim Decidim decidim
Vendors & Products		Decidim Decidim decidim

Apr 13, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.
Title		Decidim has a Cross-site scripting (XSS) vulnerability via user name field
Weaknesses		CWE-79
References		https://github.com/decidim/decidim/releases/tag/v0.30.5 https://github.com/decidim/decidim/releases/tag/v0.31.1 https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L'}`