CVE-2026-23891

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23891", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T21:02:02.902Z", "datePublished": "2026-04-13T16:52:16.448Z", "dateUpdated": "2026-04-14T16:29:24.311Z"}, "containers": {"cna": {"title": "Decidim has a Cross-site scripting (XSS) vulnerability via user name field", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g"}, {"name": "https://github.com/decidim/decidim/releases/tag/v0.30.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/releases/tag/v0.30.5"}, {"name": "https://github.com/decidim/decidim/releases/tag/v0.31.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/releases/tag/v0.31.1"}], "affected": [{"vendor": "decidim", "product": "decidim", "versions": [{"version": ">= 0.31.0.rc1, < 0.31.1", "status": "affected"}, {"version": "< 0.30.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-13T16:52:16.448Z"}, "descriptions": [{"lang": "en", "value": "Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1."}], "source": {"advisory": "GHSA-fc46-r95f-hq7g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:23:47.437196Z", "id": "CVE-2026-23891", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:29:24.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:23:47.437196Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:24:00.693Z"}}], "cna": {"title": "Decidim has a Cross-site scripting (XSS) vulnerability via user name field", "source": {"advisory": "GHSA-fc46-r95f-hq7g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "decidim", "product": "decidim", "versions": [{"status": "affected", "version": ">= 0.31.0.rc1, < 0.31.1"}, {"status": "affected", "version": "< 0.30.5"}]}], "references": [{"url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g", "name": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/decidim/decidim/releases/tag/v0.30.5", "name": "https://github.com/decidim/decidim/releases/tag/v0.30.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/decidim/decidim/releases/tag/v0.31.1", "name": "https://github.com/decidim/decidim/releases/tag/v0.31.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-13T16:52:16.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23891", "state": "PUBLISHED", "dateUpdated": "2026-04-14T16:29:24.311Z", "dateReserved": "2026-01-16T21:02:02.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-13T16:52:16.448Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "decidim", "vendor": "decidim", "versions": [{"status": "affected", "version": ">= 0.31.0.rc1, < 0.31.1"}, {"status": "affected", "version": "< 0.30.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "0EDD53FD-D485-451E-8F3A-121EF31AA587", "versionEndExcluding": "0.30.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "029260FC-BDC7-4FFF-B8DA-B7BF1BF978EC", "versionEndExcluding": "0.31.1", "versionStartIncluding": "0.31.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1."}], "id": "CVE-2026-23891", "lastModified": "2026-06-17T10:22:16.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23891", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:23:47.437196Z", "version": "2.0.3"}}]}, "published": "2026-04-13T17:16:28.063", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/decidim/decidim/releases/tag/v0.30.5"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/decidim/decidim/releases/tag/v0.31.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.31.0.rc1,0.31.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.30.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "decidim", "source": "cna", "vendor": "decidim"}, "product": "decidim", "vendor": "decidim"}], "analysis": {"en": {"generated_at": "2026-04-13T18:22:28.031952+00:00", "value": {"mitigation_remediation": ["Upgrade Decidim to version 0.30.5 or later 0.31.1", "Confirm that the application runs the patched version"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting resulting in arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Decidim users running the open\u2011source participatory democracy framework are affected. Versions lower than 0.30.5, and releases 0.31.0.rc1 to 0.31.0, are vulnerable. All other versions, including 0.30.5 and 0.31.1, contain the fix.", "description_and_impact": "This vulnerability allows a stored cross\u2011site scripting flaw through the user name field, enabling a low\u2011privileged attacker to inject code that is executed in the browser context of any visitor to a comment page. The exploited code runs with the privileges of the visiting user, providing high confidentiality and integrity impact across security boundaries.", "risk_and_exploitability": "The flaw has a high CVSS score of 9.3 and is listed as a stored XSS that facilitates arbitrary code execution. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. The attack can be performed by any user who can create or modify a comment with a maliciously crafted name; the victim simply needs to open the comment page, making exploitation highly feasible for an attacker with minimal resources."}}}}, "created": "2026-04-14T16:18:45.761229+00:00", "updated": "2026-04-14T16:33:53.903723+00:00", "vendors": ["decidim", "decidim$PRODUCT$decidim"]}