CVE-2026-23891: Decidim Framework RCE Vulnerability

CVE-2026-23891 Overview

CVE-2026-23891 is a stored Cross-Site Scripting (XSS) vulnerability affecting Decidim, an open-source participatory democracy framework used by governments and organizations worldwide. The vulnerability exists in the user name field, where insufficient input sanitization allows a low-privileged attacker to inject malicious code that executes in the browser context of any user who views a comment page containing the attacker's username.

This stored code execution flaw enables attackers to perform actions on behalf of victims, steal session tokens, redirect users to malicious sites, or exfiltrate sensitive data. Because the malicious payload persists in the application database and executes whenever the affected content is rendered, the vulnerability poses a significant risk to the confidentiality and integrity of the platform and its users.

Critical Impact

Low-privileged attackers can achieve persistent code execution in victims' browsers, compromising user sessions and enabling data theft across security boundaries on participatory democracy platforms.

Affected Products

• Decidim versions below 0.30.5
• Decidim versions 0.31.0.rc1 through 0.31.0

Discovery Timeline

• April 13, 2026 - CVE-2026-23891 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23891

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how Decidim processes and renders user-supplied input in the username field. When a user creates or modifies their account name, the application fails to properly sanitize or escape special characters before storing the value in the database and subsequently rendering it on comment pages.

The stored nature of this XSS vulnerability makes it particularly dangerous. Unlike reflected XSS attacks that require victims to click a malicious link, stored XSS payloads are automatically executed whenever any user visits a page where the malicious content is displayed. In Decidim's case, this means any user viewing comments made by an attacker would unknowingly execute the injected code.

The vulnerability enables high confidentiality and integrity impact, as attackers can access session cookies, perform actions as the victim, modify page content, or redirect users to attacker-controlled domains. The cross-security-boundary nature of the attack means administrative users visiting comment pages could have their elevated sessions compromised.

Root Cause

The root cause is insufficient input validation and output encoding in the user name processing pipeline. Decidim versions prior to 0.30.5 and version 0.31.0 do not properly sanitize user-provided name values before storing them in the database, nor do they adequately encode these values when rendering them in HTML contexts on comment pages. This allows specially crafted input containing JavaScript or HTML markup to be preserved and executed as executable code rather than displayed as literal text.

Attack Vector

The attack is network-based and requires low privileges—any authenticated user who can set a username can exploit this vulnerability. The attack flow involves an attacker registering or modifying their account to include malicious JavaScript in the username field, then posting comments on the platform. When other users, including administrators, view these comments, the malicious payload executes in their browser with full access to the DOM and user session.

The vulnerability requires passive user interaction (simply visiting a page), making it highly exploitable in active community platforms where users regularly view and participate in discussions. The attacker can target high-value victims by posting comments on popular proposals or discussions.

Detection Methods for CVE-2026-23891

Indicators of Compromise

• Unusual script tags, event handlers (e.g., onerror, onload), or JavaScript URIs in user profile name fields within the Decidim database
• Web application firewall logs showing XSS patterns in user registration or profile update requests
• Client-side errors or unexpected network requests originating from comment pages
• Reports from users about unexpected redirects or behavior when viewing comments

Detection Strategies

• Deploy web application firewall rules to detect and block XSS payloads in user input fields
• Implement Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Enable database auditing to monitor for suspicious patterns in user-controlled text fields
• Review server access logs for requests to user profile endpoints containing encoded script tags or event handlers

Monitoring Recommendations

• Configure CSP reporting to capture and alert on policy violations that may indicate XSS exploitation attempts
• Monitor Decidim application logs for unusual comment viewing patterns or high-frequency access to specific user profiles
• Set up alerts for users reporting session hijacking or unauthorized account activity
• Regularly scan the user database for stored XSS indicators using automated security tools

How to Mitigate CVE-2026-23891

Immediate Actions Required

• Upgrade Decidim to version 0.30.5 or 0.31.1 immediately to address the vulnerability
• Audit existing user accounts for potentially malicious usernames containing script tags or event handlers
• Implement Content Security Policy headers as a defense-in-depth measure while patching is in progress
• Review recent comment activity and user registrations for signs of exploitation

Patch Information

The Decidim development team has released patched versions that address this stored XSS vulnerability. Organizations should upgrade to:

• Version 0.30.5 for deployments on the 0.30.x branch - GitHub Release v0.30.5
• Version 0.31.1 for deployments on the 0.31.x branch - GitHub Release v0.31.1

For additional technical details about this vulnerability, refer to the GitHub Security Advisory GHSA-fc46-r95f-hq7g.

Workarounds

• Implement strict input validation on the user name field at the web server or reverse proxy level to block common XSS patterns
• Deploy a web application firewall with XSS detection rules in front of the Decidim application
• Enable strong Content Security Policy headers to prevent inline script execution, reducing the impact of any stored XSS
• Temporarily restrict user profile editing capabilities if immediate patching is not possible

# Example nginx configuration to add CSP headers as defense-in-depth
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';" always;