# CVE-2026-23891: Decidim stored XSS in user name field

Source: https://junglewise.ai/threats/cve-2026-23891-decidim-stored-xss-in-user-name-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-23891 · Severity: high · CVSS 8.7 · Published 2026-04-13

A stored cross-site scripting (XSS) vulnerability in Decidim allows low-privileged attackers to execute arbitrary code in the context of other users by manipulating the user name field.

Technologies: [decidim-core (RubyGems)](https://junglewise.ai/threats/technologies/decidim-core). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-23891 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23891 being exploited in the wild.

**How severe is CVE-2026-23891?** High severity, with a CVSS score of 8.7, published 13 April 2026.

**Which products and versions are affected?** decidim-core (RubyGems) ECOSYSTEM:introduced=0.31.0.rc1,fixed=0.31.1.

**Is there a fix for CVE-2026-23891?** Yes. decidim-core (RubyGems): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-23891?** Check whether you run decidim-core (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- decidim-core (RubyGems): upgrade to 0.31.1 or later

  ```sh
  bundle update decidim-core
  ```


## Affected products

- decidim-core (RubyGems) ECOSYSTEM:introduced=0.31.0.rc1,fixed=0.31.1

## Identifiers

- CVE-2026-23891
- GHSA-fc46-r95f-hq7g

## References

- [https://api.github.com/users/cyberschnaps](https://api.github.com/users/cyberschnaps)
- [https://github.com/cyberschnaps](https://github.com/cyberschnaps)
- [https://api.github.com/users/cyberschnaps/gists%7B/gist_id%7D](https://api.github.com/users/cyberschnaps/gists%7B/gist_id%7D)
- [https://api.github.com/users/cyberschnaps/repos](https://api.github.com/users/cyberschnaps/repos)
- [https://avatars.githubusercontent.com/u/7559821?v=4](https://avatars.githubusercontent.com/u/7559821?v=4)
- [https://api.github.com/users/cyberschnaps/events%7B/privacy%7D](https://api.github.com/users/cyberschnaps/events%7B/privacy%7D)

## Related threats

- [Decidim decidim-core SSRF in push notification subscriptions](https://junglewise.ai/threats/cve-2026-45573-decidim-decidim-core-ssrf-in-push-notification-subscriptions)
- [Decidim stored XSS in HTML content blocks](https://junglewise.ai/threats/cve-2026-45572-decidim-stored-xss-in-html-content-blocks)
- [Decidim improper access control in Private Data Exports](https://junglewise.ai/threats/cve-2026-45377-decidim-improper-access-control-in-private-data-exports)
- [Decidim decidim-core incorrect privilege assignment in amendments](https://junglewise.ai/threats/cve-2026-40869-decidim-decidim-core-incorrect-privilege-assignment-in-amendments)
- [Decidim's private data exports can lead to data leaks](https://junglewise.ai/threats/cve-2025-65017-decidim-s-private-data-exports-can-lead-to-data-leaks)