CVE-2026-23891

CVE-2026-23891 is a stored code execution vulnerability in Decidim, an open-source participatory democracy platform, affecting versions below 0.30.5 and 0.31.0.rc1 through 0.31.1. The flaw exists in the user name field and allows low-privileged attackers to inject and execute arbitrary code that runs in the context of any user who views affected comment pages, compromising both confidentiality and integrity across security boundaries. The vulnerability has been patched in versions 0.30.5 and 0.31.1. The attack requires network access with low privilege credentials and user interaction, as victims must passively visit a compromised comment page for exploitation. The CVSS 3.1 score of 8.7 reflects the high severity due to significant confidentiality and integrity impacts, though availability is not affected. An attacker can steal sensitive information or modify content visible to legitimate users without requiring complex technical conditions. There is currently no active exploitation detected in the wild, and this vulnerability is not included on CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00046 indicates minimal real-world exploitation likelihood compared to other CVEs, and the vulnerability has not generated substantial community attention or readily available exploit code, suggesting a measured rather than critical threat posture at present.