CVE-2026-23891

An attacker with basic privileges (e.g., a regular platform user) places a malicious payload in the username field. Since this data is not properly sanitized before display, the payload is permanently stored in the database and rendered as code in the browser of anyone visiting a page containing that user's comments. The exploit works passively — the victim does not need to take any action beyond loading the page. This mechanism allows bypassing security boundaries and affects both resources in the context of the attacked user and system resources.

An attacker can hijack the session of any user visiting a page with comments, gain access to sensitive data, and make unauthorized modifications to content or configuration — resulting in high impact on confidentiality and integrity of both user data and system resources.

Decidim should be updated to version 0.30.5 or 0.31.1, in which the issue has been fixed. Patches are available in the vendor's official GitHub repository at the addresses indicated in the references.

Decidim in versions below 0.30.5 and versions 0.31.0.rc1 through 0.31.0 inclusive